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IN  THE  UNITED  STATES  DISTRICT  COURT 
FOR  THE  DISTRICT  OF  MARYLAND 


) 

WIKIMEDIA  FOUNDATION,  ) 

) 

Plaintiff,  ) 

) 

V.  )  No.  l:15-cv-00662-TSE 

) 

NATIONAL  SECURITY  AGENCY,  et  al. ,  ) 

) 

Defendants.  ) 

_ ) 


OBJECTIONS  AND  RESPONSES  BY  DEFENDANTS  NATIONAL 
SECURITY  AGENCY  AND  ADM,  MICHAEL  S.  ROGERS,  DIRECTOR,  TO 
PLAINTIFF’S  FIRST  AND  SECOND  SETS  OF  REQUESTS  FOR  ADMISSION 

Pursuant  to  Rule  36  of  the  Federal  Rules  of  Civil  Proeedure  and  District  of  Maryland 

Local  Rule  104,  Defendants  National  Security  Agency  (“NSA”)  and  Adm.  Michael  S.  Rogers, 

Director  of  the  NSA,  in  his  official  capacity  (together,  the  “NSA  Defendants”),  by  their 

undersigned  attorneys,  object  and  respond  as  follows  to  Plaintiff  Wikimedia  Foundation’s  first 


and  second  sets  of  Requests  for  Admission,  dated  November  7  and  29,  2017,  respectively. 

GENERAL  OBJECTIONS  AND 
OBJECTIONS  TO  DEFINITIONS  AND  INSTRUCTIONS 


1 .  The  NSA  Defendants  object  to  Plaintiffs  Requests  for  Admission  to  the  extent,  as 
set  forth  in  response  to  specific  requests  below,  that  they  are  improper  attempts  to  use  requests 
for  admission  as  discovery  devices,  specifically,  as  interrogatories. 

2.  The  NSA  Defendants  object  to  Plaintiffs  Requests  for  Admission  to  the  extent,  as 
set  forth  in  response  to  specific  requests  below,  that  they  seek  information  regarding  the 
intelligence  activities  of  the  NSA,  which  is  absolutely  protected  from  disclosure  by  50  U.S.C. 


§  3605(a). 
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3.  The  NS  A  Defendants  objeet  to  Plaintiffs  Requests  for  Admission  to  the  extent,  as 
set  forth  in  response  to  speeifie  requests  below,  they  seek  information  that  is  irrelevant  to 
jurisdietional  issues,  whieh  are  the  only  matters  as  to  whieh  the  Court  has  authorized  diseovery 
in  this  ease.  See  Oetober  3,  2017,  Order,  ECF  No.  1 17  at  1. 

4.  As  set  forth  in  response  to  speeifie  requests  below,  the  NSA  Defendants  objeet  to 
the  definition  of  the  term  “Cireuit”  as  vague  and  ambiguous  insofar  as  it  is  meant,  by  its 
referenee  to  the  use  of  that  term  in  the  Privaey  and  Civil  Liberties  Oversight  Board’s  “Report  on 
the  Surveillanee  Program  Operated  Pursuant  to  Seetion  702  of  the  Foreign  Intelligenee 
Surveillanee  Act”  (the  “PCLOB  Section  702  Report”)  to  assign  the  term  “Circuit”  a  meaning 
other  than  its  ordinary  meaning  in  the  telecommunications  industry.  The  PCLOB  is  an 
independent  agency  within  the  Executive  Branch,  and  the  NSA  Defendants  do  not  have 
information  regarding  what,  if  anything,  that  entity  intended  by  the  term  “Circuit”  beyond  the 
ordinary  meaning  of  that  term  within  the  telecommunications  industry  as  understood  by  the  NSA 
Defendants. 

5.  As  set  forth  in  response  to  specific  requests  below,  the  NSA  Defendants  object  to 
the  definition  of  the  term  “Internet  Transaction”  as  vague  and  ambiguous  insofar  as  it  is  meant, 
by  its  reference  to  the  use  of  that  term  in  the  PCLOB  Section  702  Report,  to  assign  the  term 
“Internet  Transaction”  a  meaning  other  than  that  understood  by  the  NSA  Defendants.  The 
PCLOB  is  an  independent  agency  within  the  Executive  Branch,  and  the  NSA  Defendants  do  not 
have  information  regarding  what,  if  anything,  that  entity  intended  by  the  term  “Internet 
Transaction”  beyond  the  meaning  of  that  term  as  understood  by  the  NSA  Defendants. 

6.  As  set  forth  in  response  to  specific  requests  below,  the  NSA  Defendants  object  to 
the  definition  of  “Review”  as  compound,  unduly  burdensome  and  oppressive,  and  so  vague  and 
ambiguous  as  to  render  specific  requests  in  which  it  is  used  incapable  of  reasoned  response. 
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7.  As  set  forth  in  response  to  speeific  requests  below,  the  NSA  Defendants  object  to 
the  definition  of  “Interacted  With”  as  compound,  and,  insofar  as  it  incorporates  the  definition  of 
“Review,”  also  as  unduly  burdensome  and  oppressive,  and  so  vague  and  ambiguous  as  to  render 
specific  requests  in  which  it  is  used  incapable  of  reasoned  response. 

8.  As  set  forth  in  response  to  specific  requests  below,  the  NSA  Defendants  object  to 
Plaintiffs  Requests  for  Admission  to  the  extent  that  they  seek  information  that  is  protected  from 
disclosure  by  the  state  secrets  privilege,  and  the  statutory  privilege  under  50  U.S.C.  §  3024(i)(l). 

9.  The  following  objections  and  responses  are  based  upon  information  currently 
known  to  the  NSA  Defendants,  and  they  reserve  the  right  to  supplement  or  amend  their 
objections  and  responses  should  additional  or  different  information  become  available. 

10.  Nothing  contained  in  the  following  objections  and  responses  shall  be  construed  as 
a  waiver  of  any  applicable  objection  or  privilege  as  to  any  request  or  as  a  waiver  of  any  objection 
or  privilege  generally.  Inadvertent  disclosure  or  unauthorized  disclosure  of  information  subject 
to  a  claim  of  privilege  shall  not  be  deemed  a  waiver  of  such  privilege. 

OBJECTIONS  AND  RESPONSES  TO  FIRST  SET  OF  REQUESTS  FOR  ADMISSION 

REQUEST  FOR  ADMISSION  NO.  1  I  Admit  that  there  are  between  45  and  55 
international  submarine  cables  that  carry  INTERNET  COMMUNICATIONS  directly  into  or 
directly  out  of  the  UNITED  STATES. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  I  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  discovery  device,  specifically,  as  an 
interrogatory.  The  NSA  Defendants  further  object  to  Request  for  Admission  No.  1  as  unduly 
burdensome  and  oppressive  insofar  as  it  requests  that  the  NSA  Defendants  produce  information 
regarding  the  telecommunications  infrastructure  that  is  equally  available  to  the  Plaintiff  as  it  is  to 
the  NSA  Defendants  from  public  sources. 


3 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  5  of  1298 


RESPONSE:  Subject  to  the  objections  stated  above,  and  without  waiving  them,  the 
NS  A  Defendants  respond  that  it  is  difficult  to  determine  the  exact  number  of  international 
submarine  telecommunications  cables  that  carry  Internet  communications  directly  into  or  out  of 
the  United  States,  because  it  is  not  publicly  known  whether  particular  cables  carry  Internet 
communications  as  opposed  to  telephonic  or  private-network  communications.  The  Federal 
Communications  Commission,  which  issues  licenses  to  own  and  operate  submarine  cables  and 
associated  cable  landing  stations  located  in  the  United  States,  most  recently  reported  that 
approximately  45  privately  owned  trans-ocean  fiber  optic  cables  (also  referred  to  in  the  report  as 
cable  systems)  landing  in  the  United  States  or  its  territories  were  in  service  as  of  December  31, 
2015.  See  Federal  Communications  Commission,  International  Bureau  Report,  2015  U.S. 
International  Circuit  Capacity  Data  (August  2017),  at  4  &  Tables  4(A)  &  4(B)  at  T-5  to  T-8, 
available  at  https://apps.fcc.gov/edocs  public/attachmatch/DQC-346376A2.pdf 
Telecommunications  market  research  and  consulting  firm  Telegeography  publishes  an  online 
Submarine  Cable  Landing  Directory,  https://www.telegeography.com/telecom- 
resources/submarine-cable-landing-directory,  which  lists  45-50  privately  owned  international 
undersea  cable  systems  landing  in  the  United  States  or  its  territories,  many  of  which,  however, 
contain  multiple  cables  or  legs.  Telegeography  also  publishes  online  a  map  purporting  to  depict 
the  international  submarine  cables  connecting  the  United  States  with  other  nations  as  of 
December  1 1,  2017,  available  at  https://wAvw.submarinecablemap.com. 

The  NS  A  Defendants  respond  further  that,  according  to  data  available  from 
Telegeography,  international  submarine  cables  typically  contain  2-8  pairs  of  fiber-optic  cables. 
Each  fiber-optic  pair  is  typically  capable  of  carrying  between  approximately  15  and  120 
individual  communications  circuits  on  different  light  wavelengths,  depending  on  age  and 
technology  used.  As  a  result,  an  individual  submarine  cable  may  carry  between  approximately 
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30  and  960  communications  circuits.  (Individual  circuits  may  be  subdivided  further  to  ereate 
multiple  “virtual  circuits”  through  application  of  various  technologies.)  Each  wavelength  earned 
on  a  fiber-optic  pair  is  typically  capable  of  transporting  between  10  and  100  gigabits  of  data  per 
second  (10-100  Gbps),  meaning  that  a  typical  submarine  cable  can  carry  between  approximately 
300  and  96,000  Gbps  of  data. 

REQUEST  FOR  ADMISSION  NO.  2  i  Admit  that  the  international  submarine  cables 
that  earry  INTERNET  COMMUNICATIONS  direetly  into  or  directly  out  of  the  UNITED 
STATES  make  landfall  at  approximately  40  to  45  different  landing  points  within  the  UNITED 
STATES. 

OBJECTION:  The  NSA  Defendants  objeet  to  Request  for  Admission  No.  2  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  discovery  device,  specifically,  as  an 
interrogatory.  The  NSA  Defendants  further  objeet  to  Request  for  Admission  No.  2  as  unduly 
burdensome  and  oppressive  insofar  as  it  requests  that  NSA  Defendants  produce  information 
regarding  the  teleeommunications  infrastructure  that  is  equally  available  to  the  Plaintiff  as  it  is  to 
the  NSA  Defendants  from  public  sources. 

RESPONSE:  Subjeet  to  the  objeetions  stated  above,  and  without  waiving  them,  the 
NSA  Defendants  respond  that,  as  noted  in  response  to  Request  for  Admission  No.  1,  above,  it  is 
not  publiely  known  whether  particular  international  submarine  telecommunications  cables  carry 
Internet  communications  as  opposed  to  telephonic  or  private-network  eommunications,  and  it  is 
therefore  difficult  as  well  to  determine  the  exact  number  of  points  at  which  the  cables  carrying 
Internet  communieations  make  landfall  within  the  United  States.  Telegeography’s  online 
Submarine  Cable  Landing  Directory,  https://www.telegeographv.com/telecom- 
resources/submarine-cable-landing-directory,  indicates  that  international  undersea  eable  systems 
currently  in  serviee  make  landfall  within  the  territory  of  the  United  States  at  approximately  75-80 
locations. 
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REQUEST  FOR  ADMISSION  NO.  3:  Admit  that  the  INTERNET  BACKBONE 
includes  international  submarine  cables  that  carry  INTERNET  COMMUNICATIONS  into  and 
out  of  the  UNITED  STATES. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  3  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  discovery  device,  specifically,  as  an 
interrogatory.  The  NSA  Defendants  further  object  to  Request  for  Admission  No.  3  as  unduly 
burdensome  and  oppressive  insofar  as  it  requests  that  NSA  Defendants  produce  information 
regarding  the  telecommunications  infrastructure  that  is  equally  available  to  the  Plaintiff  as  it  is  to 
the  NSA  Defendants  from  public  sources. 

RESPONSE:  Subject  to  the  objections  stated  above,  and  without  waiving  them,  the 
NSA  Defendants  respond  that  yes,  the  Internet  backbone  includes  but  is  not  limited  to 
international  submarine  telecommunications  cables  that  carry  Internet  communications. 

REQUEST  FOR  ADMISSION  NO.  4:  Admit  that  the  INTERNET  BACKBONE 
includes  high-capacity  terrestrial  cables  that  carry  traffic  within  the  UNITED  STATES. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  4  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  discovery  device,  specifically,  as  an 
interrogatory.  The  NSA  Defendants  further  object  to  Request  for  Admission  No.  4  as  unduly 
burdensome  and  oppressive  insofar  as  it  requests  that  NSA  Defendants  produce  information 
regarding  the  telecommunications  infrastructure  that  is  equally  available  to  the  Plaintiff  as  it  is  to 
the  NSA  Defendants  from  public  sources. 

RESPONSE:  Subject  to  the  objections  stated  above,  and  without  waiving  them,  the 
NSA  Defendants  respond  that  yes,  the  Internet  backbone  includes  but  is  not  limited  to  high- 
capacity  terrestrial  telecommunications  cables  that  carry  Internet  communications  within  the 
United  States. 
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REQUEST  FOR  ADMISSION  NO.  5:  Admit  that,  in  conducting  Upstream 
surveillance,  the  NSA  COPIES  INTERNET  COMMUNICATIONS  that  are  in  transit  on  the 
INTERNET  BACKBONE,  prior  to  RETAINING  INTERNET  COMMUNICATIONS  that 
eontain  a  SEEECTOR. 

OBJECTION:  The  NSA  Defendants  objeet  to  Request  for  Admission  No.  5  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  diseovery  deviee,  speeifieally,  as  an 
interrogatory.  The  NSA  Defendants  further  objeet  to  Request  for  Admission  No.  5  on  the 
grounds  that  it  seeks  information  (whieh  ean  be  neither  eonfirmed  nor  denied)  regarding  alleged 
intelligence  aetivities  of  the  NSA,  whieh  is  absolutely  protected  from  disclosure  by  50  U.S.C. 

§  3605(a),  and  whieh  is  also  proteeted  from  diselosure  by  the  state  seerets  privilege,  and  the 
statutory  privilege  under  50  U.S.C.  §  3024(i)(l). 

REQUEST  FOR  ADMISSION  NO.  6:  Admit  that,  in  eondueting  Upstream 
surveillance,  the  NSA  REVIEWS  the  eontents  of  INTERNET  COMMUNICATIONS  that  are  in 
transit  on  the  INTERNET  BACKBONE,  prior  to  RETAINING  INTERNET 
COMMUNICATIONS  that  eontain  a  SEEECTOR. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  6  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  diseovery  deviee,  speeifieally,  as  an 
interrogatory.  The  NSA  Defendants  further  objeet  to  Request  for  Admission  No.  6  on  the 
grounds  that  it  seeks  information  regarding  alleged  intelligenee  aetivities  of  the  NSA,  whieh  is 
absolutely  proteeted  from  diselosure  by  50  U.S.C.  §  3605(a),  and  whieh  is  also  protected  from 
diselosure  by  the  state  seerets  privilege,  and  the  statutory  privilege  under  50  U.S.C.  §  3024(i)(l). 

The  NSA  Defendants  also  object  to  Request  for  Admission  No.  6  insofar  as  the  definition 
of  “Reviews,”  by  eneompassing  so  many  fundamentally  different  aetions,  renders  this  request 
eompound,  unduly  burdensome  and  oppressive,  vague  and  ambiguous,  and  ineapable  of  reasoned 
response. 

RESPONSE:  Subjeet  to  the  objeetions  stated  above,  and  without  waiving  them,  the 

NSA  Defendants  respond  that  in  the  eourse  of  the  Upstream  Internet  eolleetion  proeess,  eertain 
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Internet  transactions  transiting  the  Internet  backbone  networks  of  certain  electronic 
communication  service  providers  are  filtered  for  the  purpose  of  excluding  wholly  domestic 
communications;  are  then  screened  to  identify  for  acquisition  those  transactions  that  are  to  or 
from  persons  targeted  in  accordance  with  the  current  NSA  targeting  procedures;  and  must  pass 
through  both  the  filter  and  the  screen  before  they  can  be  ingested  into  Government  databases. 

REQUEST  FOR  ADMISSION  NO.  7:  Admit  that,  in  conducting  Upstream 
surveillance,  the  NSA  COPIES  INTERNET  COMMUNICATIONS  in  BULK  that  are  in  transit 
on  the  INTERNET  BACKBONE. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  7  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  discovery  device,  specifically,  as  an 
interrogatory.  The  NSA  Defendants  further  object  to  Request  for  Admission  No.  7  on  the 
grounds  that  it  seeks  information  (which  can  be  neither  confirmed  nor  denied)  regarding  alleged 
intelligence  activities  of  the  NSA,  which  is  absolutely  protected  from  disclosure  by  50  U.S.C. 

§  3605(a),  and  which  is  also  protected  from  disclosure  by  the  state  secrets  privilege,  and  the 
statutory  privilege  under  50  U.S.C.  §  3024(i)(l). 

REQUEST  FOR  ADMISSION  NO.  8:  Admit  that,  in  conducting  Upstream 
surveillance,  the  NSA  REVIEWS  the  contents  of  INTERNET  COMMUNICATIONS  in  BULK 
that  are  in  transit  on  the  INTERNET  BACKBONE. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  8  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  discovery  device,  specifically,  as  an 
interrogatory.  The  NSA  Defendants  further  object  to  Request  for  Admission  No.  8  on  the 
grounds  that  it  seeks  information  regarding  alleged  intelligence  activities  of  the  NSA,  which  is 
absolutely  protected  from  disclosure  by  50  U.S.C.  §  3605(a),  and  which  is  also  protected  from 
disclosure  by  the  state  secrets  privilege,  and  the  statutory  privilege  under  50  U.S.C.  §  3024(i)(l). 


8 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  10  of  1298 


The  NSA  Defendants  also  objeet  to  Request  for  Admission  No.  8  insofar  as  the  definition 
of  “Reviews,”  by  eneompassing  so  many  fundamentally  different  aetions,  renders  this  request 
eompound,  unduly  burdensome  and  oppressive,  vague  and  ambiguous,  and  ineapable  of  reasoned 
response. 

RESPONSE:  Subjeet  to  the  objeetions  stated  above,  and  without  waiving  them,  the 
NSA  Defendants  respond  that  in  the  eourse  of  the  Upstream  Internet  eolleetion  proeess,  certain 
Internet  transactions  transiting  the  Internet  backbone  networks  of  certain  electronic 
communication  service  providers  are  filtered  for  the  purpose  of  excluding  wholly  domestic 
communications;  are  then  screened  to  identify  for  acquisition  those  transactions  that  are  to  or 
from  persons  targeted  in  accordance  with  the  current  NSA  targeting  procedures;  and  must  pass 
through  both  the  filter  and  the  screen  before  they  can  be  ingested  into  Government  databases. 

REQUEST  FOR  ADMISSION  NO.  9:  Admit  that,  in  conducting  Upstream 
surveillance,  the  NSA  COPIES  INTERNET  COMMUNICATIONS  that  are  neither  to  nor  from 
TARGETS,  prior  to  RETAINING  INTERNET  COMMUNICATIONS  that  contain  a 
SEEECTOR. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  9  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  discovery  device,  specifically,  as  an 
interrogatory.  The  NSA  Defendants  further  object  to  Request  for  Admission  No.  9  on  the 
grounds  that  it  seeks  information  (which  can  be  neither  confirmed  nor  denied)  regarding  alleged 
intelligence  activities  of  the  NSA,  which  is  absolutely  protected  from  disclosure  by  50  U.S.C. 
§3605(a),  and  which  is  also  protected  from  disclosure  by  the  state  secrets  privilege,  and  the 
statutory  privilege  under  50  U.S.C.  §  3024(i)(l). 
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REQUEST  FOR  ADMISSION  NO.  10:  Admit  that,  in  conducting  Upstream 
surveillance,  the  NS  A  REVIEWS  the  contents  of  INTERNET  COMMUNICATIONS  that  are 
neither  to  nor  from  TARGETS,  prior  to  RETAINING  INTERNET  COMMUNICATIONS  that 
eontain  a  SELECTOR. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  10  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  discovery  device,  speeifically,  as  an 
interrogatory.  The  NSA  Defendants  further  objeet  to  Request  for  Admission  No.  10  on  the 
grounds  that  it  seeks  information  regarding  alleged  intelligenee  activities  of  the  NSA,  which  is 
absolutely  protected  from  disclosure  by  50  U.S.C.  §  3605(a),  and  which  is  also  protected  from 
disclosure  by  the  state  seerets  privilege,  and  the  statutory  privilege  under  50  U.S.C.  §  3024(i)(l). 

The  NSA  Defendants  also  object  to  Request  for  Admission  No.  10  insofar  as  the 
definition  of  “Reviews,”  by  eneompassing  so  many  fundamentally  different  actions,  renders  this 
request  compound,  unduly  burdensome  and  oppressive,  vague  and  ambiguous,  and  ineapable  of 
reasoned  response. 

RESPONSE:  Subject  to  the  objections  stated  above,  and  without  waiving  them,  the 
NSA  Defendants  respond  that  in  the  course  of  the  Upstream  Internet  colleetion  proeess,  certain 
Internet  transaetions  transiting  the  Internet  backbone  networks  of  certain  electronic 
communication  service  providers  are  filtered  for  the  purpose  of  excluding  wholly  domestic 
communications;  are  then  screened  to  identify  for  aequisition  those  transaetions  that  are  to  or 
from  persons  targeted  in  accordance  with  the  current  NSA  targeting  proeedures;  and  must  pass 
through  both  the  filter  and  the  screen  before  they  can  be  ingested  into  Government  databases. 

REQUEST  FOR  ADMISSION  NO.  11:  Admit  that  the  NSA  does  not  eonsider  an 
INTERNET  COMMUNICATION  “collected,”  within  the  meaning  of  the  2014  NSA 
Minimization  Proeedures,  until  after  it  has  REVIEWED  the  contents  of  the  communieation  and 
has  selected  it  for  RETENTION. 

OBJECTION:  The  NSA  Defendants  objeet  to  Request  for  Admission  No.  1 1  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  diseovery  deviee,  specifieally,  as  an 
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interrogatory.  The  NSA  Defendants  also  objeet  to  Request  for  Admission  No.  1 1  beeause  what 
the  NSA  “consider [s]”  the  collection  of  an  Internet  communication  to  be,  within  the  meaning  of 
the  2014  NSA  Section  702  Minimization  Procedures  or  otherwise,  is  irrelevant  to  jurisdictional 
issues,  which  are  the  only  matters  as  to  which  the  Court  has  authorized  discovery  in  this  case. 

See  October  3,  2017,  Order,  ECF  No.  1 17  at  1. 

The  NSA  Defendants  also  object  to  Request  for  Admission  No.  1 1  to  the  extent  that  it 
seeks  information  regarding  alleged  intelligence  activities  of  the  NSA,  which  is  absolutely 
protected  from  disclosure  by  50  U.S.C.  §  3605(a),  and  which  is  also  protected  from  disclosure  by 
the  state  secrets  privilege,  and  the  statutory  privilege  under  50  U.S.C.  §  3024(i)(l).  Finally,  the 
NSA  Defendants  object  to  Request  for  Admission  No.  1 1  insofar  as  the  definition  of  “Reviews,” 
by  encompassing  so  many  fundamentally  different  actions,  renders  this  request  compound, 
unduly  burdensome  and  oppressive,  vague  and  ambiguous,  and  incapable  of  reasoned  response. 

RESPONSE:  Subject  to  the  objections  stated  above,  and  without  waiving  them,  the 
NSA  Defendants  respond  that  the  NSA  considers  the  term  “collection”  as  it  applies  to  the 
Upstream  Internet  collection  process,  whether  in  the  2014  NSA  Section  702  Minimization 
Procedures  or  otherwise,  to  be  the  ingestion  of  Internet  transactions  into  Government  databases 
after  they  have  been  filtered  for  the  purpose  of  excluding  wholly  domestic  communications,  and 
then  screened  to  identify  for  acquisition  those  transactions  that  are  to  or  from  persons  targeted  in 
accordance  with  the  current  NSA  targeting  procedures. 

REQUEST  FOR  ADMISSION  NO.  12:  Admit  that,  in  the  course  of  Upstream 
surveillance,  the  NSA  RETAINS  WHOFFY  DOMESTIC  COMMUNICATIONS. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  12  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  discovery  device,  specifically,  as  an 
interrogatory.  The  NSA  Defendants  further  object  to  Request  for  Admission  No.  12  because  it 
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seeks  information  that  is  irrelevant  to  jurisdictional  issues,  which  are  the  only  matters  as  to  which 
the  Court  has  authorized  discovery  in  this  case.  See  October  3,  2017,  Order,  ECF  No.  1 17  at  1. 

RESPONSE:  Subject  to  the  objections  stated  above,  and  without  waiving  them,  the 
NS  A  Defendants  admit  that,  as  found  by  the  Privacy  and  Civil  Liberties  Oversight  Board, 
technical  measures  taken  to  prevent  acquisition  of  wholly  domestic  communications  in  the 
Upstream  Internet  collection  process  do  not  operate  perfectly.  However,  the  current  NS  A 
Section  702  Minimization  Procedures  require  that  wholly  domestic  communications  “be 
promptly  destroyed  upon  recognition,”  subject  to  limited  exceptions  described  in  Section  5 
therein. 

REQUEST  FOR  ADMISSION  NO.  13:  Admit  that  the  NSA  conducts  Upstream 
surveillance  on  multiple  INTERNET  BACKBONE  CIRCUITS. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  13  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  discovery  device,  specifically,  as  an 
interrogatory.  The  NSA  Defendants  further  object  to  Request  for  Admission  No.  13  on  the 
grounds  that  it  seeks  information  (which  can  be  neither  confirmed  nor  denied)  regarding  alleged 
intelligence  activities  of  the  NSA,  which  is  absolutely  protected  from  disclosure  by  50  U.S.C. 

§  3605(a),  and  which  is  also  protected  from  disclosure  by  the  state  secrets  privilege,  and  the 
statutory  privilege  under  50  U.S.C.  §  3024(i)(l). 

REQUEST  FOR  ADMISSION  NO.  14:  Admit  that  the  NSA  conducts  Upstream 
surveillance  on  multiple  “international  Internet  link[s],”  as  that  term  is  used  by  the  government 
in  its  submission  to  the  Foreign  Intelligence  Surveillance  Court,  titled  “Government’s  Response 
to  the  Court’s  Briefing  Order  of  May  9,  2011,”  and  filed  on  June  1,  2011,  see  [Redacted],  2011 
WE  10945618,  at  *15  (FISC  Oct.  3,  2011). 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  14  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  discovery  device,  specifically,  as  an 
interrogatory.  The  NSA  Defendants  also  object  to  Request  for  Admission  No.  14  on  the  ground 


12 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  14  of  1298 


that  it  attributes  the  phrase  “international  Internet  link”  to  a  Government  doeument  when  in  fact 
the  phrase  is  taken  from  an  opinion  of  the  Foreign  Intelligence  Surveillance  Court  that  does  not 
purport  to  quote  directly  from  the  referenced  Government  document.  See  [Redacted],  2011  WL 
10945618,  at  *15  (FISC  Oct.  3,  2011).  Whether  the  phrase  “international  Internet  link”  is 
contained  within  the  referenced  Government  document  is  information  (which  can  be  neither 
confirmed  nor  denied)  that  is  protected  from  disclosure  by  the  state  secrets  privilege  and  the 
statutory  privileges  under  50  U.S.C.  §  3024(i)(l)  and  50  U.S.C.  §3605(a). 

The  NSA  Defendants  further  object  to  Request  for  Admission  No.  14  on  the  grounds  that 
it  seeks  information  (which  can  be  neither  confirmed  nor  denied)  regarding  alleged  intelligence 
activities  of  the  NSA,  which  is  absolutely  protected  from  disclosure  by  50  U.S.C.  §  3605(a),  and 
which  is  also  protected  from  disclosure  by  the  state  secrets  privilege,  and  the  statutory  privilege 
under  50  U.S.C.  §  3024(i)(l). 

REQUEST  FOR  ADMISSION  NO.  15:  Admit  that  the  NSA  conducts  Upstream 
surveillance  at  multiple  INTERNET  BACKBONE  “chokepoints”  or  “choke  points”  (as  that  term 
is  used  by  YOU). 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  15  as  an 
improper  attempt  to  use  a  request  for  admission  as  a  discovery  device,  specifically,  as  an 
interrogatory.  The  NSA  Defendants  also  object  to  Request  for  Admission  No.  15  as  vague  and 
ambiguous  insofar  as  it  does  not  specify  where  or  in  what  context  the  NSA  Defendants  allegedly 
use  the  term  “chokepoints”  or  “choke  points.”  To  the  extent  that  Plaintiffs  reference  to  that 
term  alludes  to  what  is  described  in  the  Amended  Complaint  as  an  “NSA  slide,”  see  Am.  Compl. 
T1  68,  the  NSA  Defendants  object  to  this  request  as  implicitly  seeking  information  (which  can  be 
neither  confirmed  nor  denied)  regarding  the  authenticity  of  the  purported  slide,  which  is 
absolutely  protected  from  disclosure  by  50  U.S.C.  §  3605(a),  and  which  is  also  protected  from 

disclosure  by  the  state  secrets  privilege,  and  the  statutory  privilege  under  50  U.S.C.  §  3024(i)(l). 
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The  NSA  Defendants  further  objeet  to  Request  for  Admission  No.  15  on  the  grounds  that 
it  seeks  information  (whieh  ean  be  neither  eonfirmed  nor  denied)  regarding  alleged  intelligenee 
aetivities  of  the  NSA,  whieh  is  absolutely  proteeted  from  diselosure  by  50  U.S.C.  §  3605(a),  and 
whieh  is  also  protected  from  disclosure  by  the  state  secrets  privilege,  and  the  statutory  privilege 
under  50  U.S.C.  §  3024(i)(l). 

REQUEST  FOR  ADMISSION  NO.  16:  Admit  that  the  document  attached  hereto  as 
Exhibit  A,  titled  “Why  are  we  interested  in  HTTP?,”  is  a  true  and  correct  excerpted  copy  of  a 
genuine  document. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  16  as 
irrelevant,  and  as  vague  and  ambiguous  insofar  as  it  does  not  specify  what  kind  of  document 
Plaintiff  claims  Exhibit  A  “genuine[ly]”  to  be.  To  the  extent  that  Plaintiff  seeks  to  establish  the 
authenticity  of  Exhibit  A  as  evidence  of  intelligence  activities  allegedly  conducted  by  the  NSA, 
Defendants  also  object  to  Request  for  Admission  No.  16  on  the  grounds  that  it  seeks  information 
(which  can  be  neither  confirmed  nor  denied)  that  is  protected  from  disclosure  by  the  state  secrets 
privilege  and  the  statutory  privileges  under  50  U.S.C.  §  3024(i)(l)  and  50  U.S.C.  §  3605(a). 

REQUEST  FOR  ADMISSION  NO.  17:  Admit  that  the  statements  within  the  document 
attached  hereto  as  Exhibit  A  were  made  by  YOUR  employees  on  matters  within  the  scope  of 
their  employment  during  the  course  of  their  employment. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  17  as 
irrelevant,  and,  to  the  extent  Plaintiff  seeks  to  establish  the  admissibility  of  statements  made  in 
Exhibit  A  as  evidence  of  intelligence  activities  allegedly  conducted  by  the  NSA,  on  the  grounds 
that  this  request  seeks  information  (which  can  be  neither  confirmed  nor  denied)  that  is  protected 
from  disclosure  by  the  state  secrets  privilege  and  the  statutory  privileges  under  50  U.S.C. 

§  3024(0(1)  and  50  U.S.C.  §  3605(a). 


14 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  16  of  1298 


REQUEST  FOR  ADMISSION  NO.  18:  Admit  that  statements  within  the  document 
attached  hereto  as  Exhibit  A  were  made  by  persons  YOU  authorized  to  make  statements  on  the 
subjects  of  the  statements  within  the  document. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  18  as 
irrelevant,  and,  to  the  extent  Plaintiff  seeks  to  establish  the  admissibility  of  statements  made  in 
Exhibit  A  as  evidence  of  intelligence  activities  allegedly  conducted  by  the  NSA,  on  the  ground 
that  this  request  seeks  information  (which  can  be  neither  confirmed  nor  denied)  that  is  protected 
from  disclosure  by  the  state  secrets  privilege  and  the  statutory  privileges  under  50  U.S.C. 

§  3024(0(1)  and  50  U.S.C.  §  3605(a). 

REQUEST  FOR  ADMISSION  NO.  19:  Admit  that  the  document  attached  hereto  as 
Exhibit  B,  titled  “Eingerprints  and  Appids,”  and  “Eingerprints  and  Appids  (more),”  is  a  true  and 
correct  excerpted  copy  of  a  genuine  document. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  19  as 
irrelevant,  and  as  vague  and  ambiguous  insofar  as  it  does  not  specify  what  kind  of  document 
Plaintiff  claims  Exhibit  B  “genuine[ly]”  to  be.  To  the  extent  that  Plaintiff  seeks  to  establish  the 
authenticity  of  Exhibit  B  as  evidence  of  intelligence  activities  allegedly  conducted  by  the  NSA, 
Defendants  also  object  to  Request  for  Admission  No.  19  on  the  grounds  that  it  seeks  information 
(which  can  be  neither  confirmed  nor  denied)  that  is  protected  from  disclosure  by  the  state  secrets 
privilege  and  the  statutory  privileges  under  50  U.S.C.  §  3024(i)(l)  and  50  U.S.C.  §  3605(a). 


REQUEST  FOR  ADMISSION  NO.  20:  Admit  that  the  statements  within  the  document 
attached  hereto  as  Exhibit  B  were  made  by  YOUR  employees  on  matters  within  the  scope  of 
their  employment  during  the  course  of  their  employment. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  20  as 
irrelevant,  and,  to  the  extent  Plaintiff  seeks  to  establish  the  admissibility  of  statements  made  in 
Exhibit  B  as  evidence  of  intelligence  activities  allegedly  conducted  by  the  NSA,  on  the  ground 
that  this  request  seeks  information  (which  can  be  neither  confirmed  nor  denied)  that  is  protected 
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from  disclosure  by  the  state  seerets  privilege  and  the  statutory  privileges  under  50  U.S.C. 

§  3024(0(1)  and  50  U.S.C.  §  3605(a). 

REQUEST  FOR  ADMISSION  NO.  21:  Admit  that  statements  within  the  document 
attached  hereto  as  Exhibit  B  were  made  by  persons  YOU  authorized  to  make  statements  on  the 
subjects  of  the  statements  within  the  doeument. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  21  as 
irrelevant,  and,  to  the  extent  Plaintiff  seeks  to  establish  the  admissibility  of  statements  made  in 
Exhibit  B  as  evidence  of  intelligence  activities  allegedly  conducted  by  the  NSA,  on  the  ground 
that  this  request  seeks  information  (which  can  be  neither  confirmed  nor  denied)  that  is  protected 
from  diselosure  by  the  state  secrets  privilege  and  the  statutory  privileges  under  50  U.S.C. 

§  3024(0(1)  and  50  U.S.C.  §  3605(a). 


REQUEST  FOR  ADMISSION  NO.  22:  Admit  that  the  document  attaehed  hereto  as 
Exhibit  C,  “Seven  Access  Sites — International  ‘Choke  Points’,”  is  a  true  and  correct  excerpted 
copy  of  a  genuine  doeument. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  22  as 
irrelevant,  and  as  vague  and  ambiguous  insofar  as  it  does  not  speeify  what  kind  of  doeument 
Plaintiff  claims  Exhibit  C  “genuine[ly]”  to  be.  To  the  extent  that  Plaintiff  seeks  to  establish  the 
authenticity  of  Exhibit  C  as  evidence  of  intelligenee  activities  allegedly  eonducted  by  the  NSA, 
Defendants  also  objeet  to  Request  for  Admission  No.  22  on  the  grounds  that  it  seeks  information 
(whieh  can  be  neither  confirmed  nor  denied)  that  is  protected  from  disclosure  by  the  state  secrets 
privilege  and  the  statutory  privileges  under  50  U.S.C.  §  3024(i)(l)  and  50  U.S.C.  §  3605(a). 


REQUEST  FOR  ADMISSION  NO.  23:  Admit  that  the  statements  within  the  doeument 
attached  hereto  as  Exhibit  C  were  made  by  YOUR  employees  on  matters  within  the  scope  of 
their  employment  during  the  eourse  of  their  employment. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  23  as 
irrelevant,  and,  to  the  extent  Plaintiff  seeks  to  establish  the  admissibility  of  statements  made  in 
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Exhibit  C  as  evidence  of  intelligence  activities  allegedly  conducted  by  the  NS  A,  on  the  ground 
that  this  request  seeks  information  (which  can  be  neither  confirmed  nor  denied)  that  is  protected 
from  disclosure  by  the  state  secrets  privilege  and  the  statutory  privileges  under  50  U.S.C. 

§  3024(0(1)  and  50  U.S.C.  §  3605(a). 

REQUEST  FOR  ADMISSION  NO.  24:  Admit  that  statements  within  the  document 
attached  hereto  as  Exhibit  C  were  made  by  persons  YOU  authorized  to  make  statements  on  the 
subjects  of  the  statements  within  the  document. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  24  as 
irrelevant,  and,  to  the  extent  Plaintiff  seeks  to  establish  the  admissibility  of  statements  made  in 
Exhibit  C  as  evidence  of  intelligence  activities  allegedly  conducted  by  the  NSA,  on  the  ground 
that  this  request  seeks  information  (which  can  be  neither  confirmed  nor  denied)  that  is  protected 
from  disclosure  by  the  state  secrets  privilege  and  the  statutory  privileges  under  50  U.S.C. 

§  3024(0(1)  and  50  U.S.C.  §  3605(a). 

REQUEST  FOR  ADMISSION  NO.  25:  Admit  that  the  document  attached  hereto  as 
Exhibit  D,  titled  “SSO’s  Support  to  the  EBI  for  Implementation  of  their  Cyber  EISA  Orders,”  is  a 
true  and  correct  copy  of  a  genuine  document. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  25  as 
irrelevant,  and  as  vague  and  ambiguous  insofar  as  it  does  not  specify  what  kind  of  document 
Plaintiff  claims  Exhibit  D  “genuine[fy]”  to  be.  To  the  extent  that  Plaintiff  seeks  to  establish  the 
authenticity  of  Exhibit  D  as  evidence  of  intelligence  activities  allegedly  conducted  by  the  NSA, 
Defendants  also  object  to  Request  for  Admission  No.  25  on  the  grounds  that  it  seeks  information 
(which  can  be  neither  confirmed  nor  denied)  that  is  protected  from  disclosure  by  the  state  secrets 
privilege  and  the  statutory  privileges  under  50  U.S.C.  §  3024(i)(l)  and  50  U.S.C.  §  3605(a). 
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REQUEST  FOR  ADMISSION  NO.  26:  Admit  that  the  statements  within  the  doeument 
attaehed  hereto  as  Exhibit  D  were  made  by  YOUR  employees  on  matters  within  the  seope  of 
their  employment  during  the  eourse  of  their  employment. 

OBJECTION:  The  NSA  Defendants  objeet  to  Request  for  Admission  No.  26  as 
irrelevant,  and,  to  the  extent  Plaintiff  seeks  to  establish  the  admissibility  of  statements  made  in 
Exhibit  D  as  evidenee  of  intelligenee  aetivities  allegedly  eondueted  by  the  NSA,  on  the  ground 
that  this  request  seeks  information  (whieh  can  be  neither  confirmed  nor  denied)  that  is  protected 
from  disclosure  by  the  state  secrets  privilege  and  the  statutory  privileges  under  50  U.S.C. 

§  3024(0(1)  and  50  U.S.C.  §  3605(a). 

REQUEST  FOR  ADMISSION  NO.  27:  Admit  that  statements  within  the  document 
attached  hereto  as  Exhibit  D  were  made  by  persons  YOU  authorized  to  make  statements  on  the 
subjects  of  the  statements  within  the  document. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  27  as 
irrelevant,  and,  to  the  extent  Plaintiff  seeks  to  establish  the  admissibility  of  statements  made  in 
Exhibit  D  as  evidence  of  intelligence  activities  allegedly  conducted  by  the  NSA,  on  the  ground 
that  this  request  seeks  information  (which  can  be  neither  confirmed  nor  denied)  that  is  protected 
from  disclosure  by  the  state  secrets  privilege  and  the  statutory  privileges  under  50  U.S.C. 

§  3024(0(1)  and  50  U.S.C.  §  3605(a). 


REQUEST  FOR  ADMISSION  NO.  28:  Admit  that  the  document  attached  hereto  as 
Exhibit  E,  titled  “Procedures  Used  by  the  National  Security  Agency  for  Targeting  Non-United 
States  Persons  Reasonably  Believed  to  be  Eocated  Outside  the  United  States  to  Acquire  Eoreign 
Intelligence  Information  Pursuant  to  Section  702  of  the  Eoreign  Intelligence  Surveillance  Act  of 
1978,  as  Amended”  and  dated  July  28,  2009  (the  “NSA  Targeting  Procedures”)  is  a  true  and 
correct  copy  of  a  genuine  document. 

OBJECTION:  To  the  extent  that  Plaintiff  seeks  to  establish  the  authenticity  of 
Exhibit  E  as  evidence  of  targeting  procedures  allegedly  used  by  the  NSA  in  2009,  the  NSA 
Defendants  object  to  Request  for  Admission  No.  28  (i)  as  irrelevant  to  jurisdictional  issues, 
which  are  the  only  matters  as  to  which  the  Court  has  authorized  discovery  in  this  case,  see 
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October  3,  2017,  Order,  ECF  No.  117  at  1,  (ii)  as  irrelevant,  in  partieular,  to  Plaintiffs  standing 
to  seek  prospective  relief,  and  (iii)  on  the  ground  that  it  seeks  information  (which  can  be  neither 
confirmed  nor  denied)  that  is  proteeted  from  disclosure  by  the  state  secrets  privilege  and  the 
statutory  privileges  under  50  U.S.C.  §  3024(i)(l)  and  50  U.S.C.  §  3605(a). 

REQUEST  FOR  ADMISSION  NO.  29:  Admit  that  the  statements  within  the  doeument 
attached  hereto  as  Exhibit  E  were  made  by  YOUR  employees  on  matters  within  the  scope  of 
their  employment  during  the  eourse  of  their  employment. 

OBJECTION:  To  the  extent  Plaintiff  seeks  to  establish  the  admissibility  of  statements 
made  in  Exhibit  E  as  evidenee  of  intelligence  aetivities  allegedly  eonducted  by  the  NSA  in  2009, 
the  NSA  Defendants  object  to  Request  for  Admission  No.  29  as  irrelevant  and  on  the  grounds 
that  it  seeks  information  (whieh  ean  be  neither  confirmed  nor  denied)  that  is  protected  from 
disclosure  by  the  state  seerets  privilege  and  the  statutory  privileges  under  50  U.S.C.  §  3024(i)(l) 
and  50  U.S.C.  §  3605(a). 

REQUEST  FOR  ADMISSION  NO.  30:  Admit  that  statements  within  the  document 
attaehed  hereto  as  Exhibit  E  were  made  by  persons  YOU  authorized  to  make  statements  on  the 
subjects  of  the  statements  within  the  doeument. 

OBJECTION:  To  the  extent  Plaintiff  seeks  to  establish  the  admissibility  of  statements 
made  in  Exhibit  E  as  evidence  of  intelligence  activities  allegedly  eonducted  by  the  NSA  in  2009, 
the  NSA  Defendants  object  to  Request  for  Admission  No.  30  as  irrelevant  and  on  the  grounds 
that  it  seeks  information  (which  can  be  neither  eonfirmed  nor  denied)  that  is  protected  from 
disclosure  by  the  state  seerets  privilege  and  the  statutory  privileges  under  50  U.S.C.  §  3024(i)(l) 
and  50  U.S.C.  §  3605(a). 
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REQUEST  FOR  ADMISSION  NO.  31:  Admit  that  the  document  attached  hereto  as 
Exhibit  F,  titled  “Minimization  Procedures  Used  by  the  National  Security  Agency  in  Connection 
with  Acquisitions  of  Foreign  Intelligence  Information  Pursuant  to  Section  702  of  the  Foreign 
Intelligence  Surveillance  Act  of  1978,  As  Amended,”  dated  July  2014,  and  available  at 
https://www.dni.gOv/files/documents/0928/2014%20NSA%20702%20Minimization%20Procedures.pdf, 
is  a  true  and  correct  copy  of  a  genuine  document. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  3 1  as 
irrelevant  to  jurisdictional  issues,  which  are  the  only  matters  as  to  which  the  Court  has  authorized 
discovery  in  this  case.  See  October  3,  2017,  Order,  ECF  No.  1 17  at  1. 

RESPONSE:  Subject  to  the  objection  stated  above,  and  without  waiving  it,  the  NSA 
Defendants  admit  that  Exhibit  1  hereto  is  a  true  and  correct  (public)  copy  of  the  “Minimization 
Procedures  Used  by  the  National  Security  Agency  in  Connection  with  Acquisitions  of  Foreign 
Intelligence  Information  Pursuant  to  Section  702  of  the  Foreign  Intelligence  Surveillance  Act  of 
1978,  As  Amended,”  dated  July  2014,  and  available  at 

https://www.dni.gOv/files/documents/0928/2014%20NSA%20702%20Minimization%20Procedures.pdf. 

REQUEST  FOR  ADMISSION  NO.  32:  Admit  that  the  statements  within  the  document 
attached  hereto  as  Exhibit  F  were  made  by  YOUR  employees  on  matters  within  the  scope  of 
their  employment  during  the  course  of  their  employment. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  32  as 
irrelevant  to  jurisdictional  issues,  which  are  the  only  matters  as  to  which  the  Court  has  authorized 
discovery  in  this  case.  See  October  3,  2017,  Order,  ECF  No.  1 17  at  1. 

RESPONSE:  Denied.  The  2014  NSA  Section  702  Minimization  Procedures,  Exhibit  1 
hereto,  were  adopted  by  the  Attorney  General  of  the  United  States,  in  consultation  with  the 
Director  of  National  Intelligence,  as  attested  by  the  Attorney  General’s  signature  thereto. 
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REQUEST  FOR  ADMISSION  NO.  33:  Admit  that  statements  within  the  document 
attached  hereto  as  Exhibit  F  were  made  by  persons  YOU  authorized  to  make  statements  on  the 
subjects  of  the  statements  within  the  document. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  33  as 
irrelevant  to  jurisdictional  issues,  which  are  the  only  matters  as  to  which  the  Court  has  authorized 
discovery  in  this  case.  See  October  3,  2017,  Order,  ECF  No.  1 17  at  1. 

RESPONSE:  Denied.  The  2014  NSA  Section  702  Minimization  Procedures,  Exhibit  1 
hereto,  were  adopted  by  the  Attorney  General  of  the  United  States,  in  consultation  with  the 
Director  of  National  Intelligence,  as  attested  by  the  Attorney  General’s  signature  thereto. 

OBJECTIONS  AND  RESPONSES  TO  SECOND  SET  OF  REQUESTS  FOR  ADMISSION 

REQUEST  FOR  ADMISSION  NO.  34:  Admit  that,  in  conducting  Upstream 
surveillance,  the  NSA  has  COPIED  at  least  one  WIKIMEDIA  INTERNET 
COMMUNICATION. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  34  on  the 
grounds  that  it  seeks  information  (which  can  be  neither  confirmed  nor  denied)  that  is  protected 
from  disclosure  by  the  state  secrets  privilege  and  the  statutory  privilege  under  50  U.S.C. 

§  3024(i)(l).  The  NSA  Defendants  further  object  to  Request  for  Admission  No.  34  on  the 
grounds  that  it  seeks  information  regarding  alleged  intelligence  activities  of  the  NSA,  which  is 
absolutely  protected  from  disclosure  by  50  U.S.C.  §  3605(a). 

REQUEST  FOR  ADMISSION  NO.  35:  Admit  that,  in  conducting  Upstream 
surveillance,  the  NSA  has  REVIEWED  the  content  of  at  least  one  WIKIMEDIA  INTERNET 
COMMUNICATION. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  35  on  the 
grounds  that  it  seeks  information  (which  can  be  neither  confirmed  nor  denied)  that  is  protected 
from  disclosure  by  the  state  secrets  privilege  and  the  statutory  privilege  under  50  U.S.C. 

§  3024(i)(l).  The  NSA  Defendants  further  object  to  Request  for  Admission  No.  35  on  the 
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grounds  that  it  seeks  information  regarding  alleged  intelligenee  activities  of  the  NSA,  which  is 
absolutely  protected  from  disclosure  by  50  U.S.C.  §  3605(a). 

The  NSA  Defendants  also  object  to  Request  for  Admission  No.  35  insofar  as  the 
definition  of  “Review[ed],”  by  encompassing  so  many  fundamentally  different  actions,  renders 
this  request  compound,  unduly  burdensome  and  oppressive,  vague  and  ambiguous,  and  incapable 
of  reasoned  response. 

REQUEST  FOR  ADMISSION  NO.  36:  Admit  that,  in  conducting  Upstream 
surveillance,  the  NSA  has  RETAINED  at  least  one  WIKIMEDIA  INTERNET 
COMMUNICATION. 

OBJECTION:  The  NSA  Defendants  object  to  Request  for  Admission  No.  36  on  the 
grounds  that  it  seeks  information  (which  can  be  neither  confirmed  nor  denied)  that  is  protected 
from  disclosure  by  the  state  secrets  privilege  and  the  statutory  privilege  under  50  U.S.C. 

§  3024(i)(l).  The  NSA  Defendants  further  object  to  Request  for  Admission  No.  36  on  the 
grounds  that  it  seeks  information  regarding  alleged  intelligence  activities  of  the  NSA,  which  is 
absolutely  protected  from  disclosure  by  50  U.S.C.  §  3605(a). 

Dated;  January  8,  2018 


CHAD  A.  READEER 

Acting  Assistant  Attorney  General 

ANTHONY  J.  COPPOEINO 
Deputy  Branch  Director 

/s/ James  J.  Gillisan _ 

JAMES  J.  GILEIGAN 
Special  Eitigation  Counsel 

RODNEY  PATTON 
Senior  Trial  Counsel 
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JULIA  A.  BERMAN 
TIMOTHY  A.  JOHNSON 
Trial  Attorneys 

U.S  Department  of  Justice 

Civil  Division,  Federal  Programs  Branch 

20  Massachusetts  Ave.,  N.W.,  Room  6102 

Washington,  D.C.  20001 

Phone:  (202)514-3358 

Fax:  (202)616-8470 

Email :  j ames . gilligan@usdoj  .gov 

Counsel  for  the  NSA  Defendants 
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EXHIBIT  B 


if  e  r 

.  i 


MINIMIZATION  PROCEDURES  USED  BY  THE  NATIONAL  SECUi^t^fti^CSiNfi^ 
CONNECTION  WITH  ACQUISITIONS  OF  FOREIGN  INTELLIGENCE 
INFORMATION  PURSUANT  TO  SECTION  702  OF  THE  FOREIGNTNlTEUnGENCiE  f  , 
SURVEILLANCE  ACT  OF  1978,  AS  AMENDED  Ci  r  -  ^  “ 

(U)  Section  1  -  Applicability  and  Scope 

( 

(U)  These  National  Security  Agency  (NSA)  minimization  procedures  apply  to  the 
acquisition,  retention,  use,  and  dissemination  of  information,  including  non-publicly 
available  information  concerning  unconsenting  United  States  persons,  that  is  acquired  by 
targeting  non-United  States  persons  reasonably  believed  to  be  located  outside  the  United 
States  in  accordance  with  section  702  of  the  Foreign  Intelligence  Surveillance  Act  of  1978, 
as  amended  (FISA  or  "the  Act"). 


(U)  If  NSA  determines  that  it  must  take  action  in  apparent  departure  from  these 
minimization  procedures  to  protect  against  an  immediate  threat  to  human  life  (e.g.,  force 
protection  or  hostage  situations)  and  that  it  is  not  feasible  to  obtain  a  timely  modification  of 
these  procedures,  NSA  may  take  such  action  immediately.  NSA  will  report  the  action  taken 
to  the  Office  of  the  Director  of  National  Intelligence  and  to  die  National  Security  Division  of 
the  Department  of  Justice,  which  will  promptly  notify  the  Foreign  Intelligence  Surveillance 
Court  of  such  activity. 


(S//NF)-  Nothing  in  these  procedures  shall  restrict  NSA's  performance  of  lawful  oversight 
functions  of  its  personnel  or  systems,  or  lawful  oversight  functions  of  the  Department  of 
Justice's  National  Security  Division,  Office  of  the  Director  of  National  Intelligence,  or  the 
applicable  Offices  of  the  Inspectors  General.  Additionally,  nothing  in  these  procedures  shall 
restrict  NSA's  ability  to  conduct  vulnerability  or  network  assessments  using  infoimation 
acquired  pursuant  to  section  702  of  the  Act  in  order  to  ensure  that  NSA  systems  are  not  or 
have  not  been  compromised.  Notwitlistanding  any  other  section  in  these  procedures, 
information  used  by  NSA  to  conduct  vulnerability  or  network  assessments  may  be  retained 
for  one  year  solely  for  that  limited  purpose.  Any  information  retained  for  this  purpose  may 
be  disseminated  only  in  accordance  with  the  applicable  provisions  of  these  procedm'es. 


(U)  For  the  purposes  of  these  procedures,  the  terms  "National  Security  Agency"  and  "NSA 
personnel"  refer  to  any  employees  of  the  National  Security  Agency/Central  Security  Service 
("NSA/CSS"  or  "NSA")  and  any  other  persomiel  engaged  in  Signals  Intelligence  (SIGINT) 
operations  authorized  pursuant  to  section  702  of  the  Act  if  such  operations  are  executed 
under  the  direction,  authority,  or  control  of  the  Director,  NS  A/Chief,  CSS  (DIRNSA). 

(U)  Section  2  -  Definitions 

(U)  In  addition  to  the  definitions  in  sections  101  and  701  of  the  Act,  the  following 
definitions  will  apply  to  these  procedui'es: 

Derived  From:  NSA/CSSM  1-52 
Dated:  20070108 
Declassify  On:  2032010fr 
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(a)  (U)  Acquisition  means  the  collection  by  NSA  or  the  Federal  Bureau  of  Investigation 
(FBI)  through  electronic  means  of  a  non-public  communication  to  which  it  is  not  an 
intended  party. 

(b)  (U)  Communications  concerning  a  United  States  person  include  all  communications  in 
wliich  a  United  States  person  is  discussed  or  mentioned,  except  where  such 
communications  reveal  only  publicly  available  infonnation  about  the  person. 

(c)  (U)  Communications  of  a  United  States  person  include  all  communications  to  which  a 
United  States  person  is  a  party. 

(d)  (U)  Consent  is  the  agreement  by  a  person  or  organization  to  permit  the  NSA  to  take 
particular  actions  that  affect  the  person  or  organization.  To  be  effective,  consent  must  be 
given  by  the  affected  person  or  organization  with  sufficient  knowledge  to  understand  the 
action  that  may  be  taken  and  the  possible  consequences  of  that  action.  Consent  by  an 
organization  will  be  deemed  valid  if  given  on  behalf  of  the  organization  by  an  official  or 
governing  body  determined  by  the  General  Counsel,  NSA,  to  have  actual  or  apparent 
authority  to  make  such  an  agreement. 

(e)  (U)  Foreign  communication  means  a  communication  that  has  at  least  one  communicant 
outside  of  tlie  United  States.  All  other  communications,  including  communications  hi 
which  the  sender  and  all  intended  recipients  are  reasonably  believed  to  be  located  in  the 
United  States  at  the  time  of  acquisition,  are  domestic  communications. 

(f)  (U)  Identification  of  a  United  States  person  means  (1)  the  name,  unique  title,  or  address 
of  a  United  States  person;  or  (2)  other  personal  identifiers  of  a  United  States  person  when 
appearing  in  the  context  of  activities  conducted  by  tliat  person  or  activities  conducted  by 
others  that  are  related  to  that  person.  A  reference  to  a  product  by  brand  name,  or 
manufacturer's  name  or  the  use  of  a  name  in  a  descriptive  sense,  e.g.,  "Monroe  Doctrine," 
is  not  an  identification  of  a  United  States  person. 

(g)  (TS//SI//NF)  Internet  transaction,  for  puiposes  of  these  procedures,  means  an  Internet 

communication  that  is  acquired  through  NSA's  upstream  collection  techniques.  An 
Internet  transaction  may  contain  information  or  data  representing  either  a  discret^^^ 
communication  multiple  discrete  communications 


(li)  (U)  Processed  or  processing  means  any  step  necessary  to  convert  a  communication  into 
an  intelligible  form  intended  for  human  inspection. 

(i)  (U)  Publicly  available  information  means  information  that  a  member  of  the  public  could 
obtain  on  request,  by  research  in  public  sources,  or  hy  casual  observation. 

(i)  (U)  Technical  data  base  means  infonnation  retained  for  cryptanalytic,  traffic  analjdic,  or 
signal  exploitation  purposes. 
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(k)  (U)  United  States  person  means  a  United  States  person  as  defined  in  the  Act.  The 

following  guidelines  apply  in  determining  whether  a  person  whose  status  is  unknown  is  a 

United  States  person: 

(1)  (U)  A  person  known  to  be  currently  in  the  United  States  will  be  treated  as  a  United 
States  person  unless  positively  identified  as  an  alien  who  has  not  been  admitted  for 
permanent  residence,  or  unless  the  nature  or  circumstances  of  the  person's 
communications  give  rise  to  a  reasonable  belief  that  such  person  is  not  a  United 
States  person. 

(2)  (U)  A  person  loiown  to  be  currently  outside  the  United  States,  or  whose  location  is 
unknown,  will  not  be  treated  as  a  United  States  person  unless  such  person  can  be 
positively  identified  as  such,  or  the  nature  or  circumstances  of  the  person's 
communications  give  rise  to  a  reasonable  belief  that  such  person  is  a  United  States 
person. 

(3)  (U)  A  person  who  at  any  time  has  been  known  to  have  been  an  alien  admitted  for 
lawful  permanent  residence  is  treated  as  a  United  States  person.  Any  deteimination 
that  a  person  who  at  one  time  was  a  United  States  person  (mcluding  an  alien  admitted 
for  lawful  permanent  residence)  is  no  longer  a  United  States  person  must  be  made  in 
consultation  with  the  NS  A  Office  of  General  Counsel. 

(4)  (U)  An  unincorporated  association  whose  headquarters  or  primary  office  is  located 
outside  the  United  States  is  presumed  not  to  be  a  United  States  person  unless  there  is 
information  indicating  that  a  substantial  number  of  its  members  are  citizens  of  the 
United  States  or  aliens  lawfully  admitted  for  peimanent  residence. 

(U)  Section  3  -  Acquisition  and  Handling  -  General 

(a)  (U)  Acquisition 

(U)  The  acquisition  of  infoimation  by  targeting  non-United  States  persons  reasonably 
believed  to  be  located  outside  the  United  States  pursuant  to  section  702  of  the  Act  will  be 
effected  in  accordance  with  an  authorization  made  by  the  Attorney  General  and  Director  of 
National  Intelligence  pursuant  to  subsection  702(a)  of  the  Act  and  will  be  conducted  in  a 
manner  designed,  to  the  greatest  extent  reasonably  feasible,  to  minimize  the  acquisition  of 
information  not  relevant  to  the  autlrorized  purpose  of  the  acquisition. 

(b)  (U)  Monitoring,  Recording,  and  Handling 

(1)  (U)  Personnel  will  exercise  reasonable  judgment  in  determining  whether  information 
acquired  must  be  minimized  and  will  destroy  inadvertently  acquired  communications 
of  or  concerning  a  United  States  person  at  the  earliest  practicable  point  at  which  such 
communication  can  be  identified  either;  as  clearly  not  relevant  to  the  authorized 
purpose  of  the  acquisition  (e.g.,  the  commimication  does  not  contain  foreign 
intelligence  information);  or,  as  not  containing  evidence  of  a  crime  which  may  be 
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disseminated  under  these  procedures.  Except  as  provided  for  in  subsection  3(c) 
below,  such  inadvertently  acquired  eommunications  of  or  concerning  a  United  States 
person  may  be  retained  no  longer  than  five  years  from  the  expiration  date  of  the 
eertification  authorizing  the  coll  ection  in  any  event. 

(2)  (U)  Communications  of  or  concerning  United  States  persons  that  may  be  related  to 
the  authorized  purpose  of  the  acquisition  may  be  forwarded  to  analytic  personnel 
responsible  for  producing  intelligence  information  from  the  collected  data.  Such 
communications  or  information  may  be  retained  and  disseminated  only  in  accordance 
with  Sections  3,  4,  5,  6,  and  8  of  these  procedures. 

(3)  (U//FOUO)  As  a  communication  is  reviewed,  NSA  analyst(s)  will  detennine  whether 
it  is  a  domestic  or  foreign  communication  to,  from,  or  about  a  target  and  is  reasonably 
believed  to  contain  foreign  intelligence  information  or  evidence  of  a  crime  for 
purposes  of  assessing  how  the  communication  should  be  handled  in  accordance  with 
these  procedures. 

(4)  (U)  Handling  of  Internet  Transactions  Acquired  Through  NSA  Upstream  Collection 
Techniques 

a.  (TS//SI//NF)  NSA  will  take  reasonable  steps  post-acquisition  to  identify  and 
segregate  through  technical  means  Internet  transactions  that  cannot  be  reasonably 
identified  as  containing  single,  discrete  communications  where:  the  active  user  of 
the  transaction  (i.e.,  the  electronic  coimnunications  account/address/identifier 
used  to  send  or  receive  the  Internet  transaction  to  or  from  a  service  provider)  is 
reasonably  believed  to  be  located  in  the  United  States;  or  tlie  location  of  the  active 
user  is  unknown. 

1.  (TS//SE/NF)  Notwitlistanding  subsection  3  (b)(4)a.  above,  NSA  may  process 
Internet  transactions  acquired  through  NSA  upstream  collection  techniques  in 
order  to  render  such  transactions  mtelligible  to  analysts. 

2.  (TS/ZSI/zT-fF)  Internet  transactions  that  are  identified  and  segregated  pursuant 
to  subsection  3(b)(4)a.  will  be  retained  in  an  access-controlled  repository  that 
is  accessible  only  to  NSA  analysts  who  have  been  trained  to  review  such 
transactions  for  the  purpose  of  identifying  those  that  contain  discrete 
commimications  as  to  which  the  sender  and  all  intended  recipients  are 
reasonably  believed  to  be  located  in  tlie  United  States. 

(a)  (TS//SF/NF)  Any  information  contained  in  a  segregated  Internet 
transaction  (including  metadata)  may  not  be  moved  or  copied  from  the 
segregated  repository  or  otherwise  used  for  foreign  intelligence  purposes 
miless  it  has  been  determined  tliat  the  transaction  does  not  contain  any 
discrete  communication  as  to  which  the  sender  and  all  intended  recipients 
are  reasonably  believed  to  be  located  in  tlie  United  States.  Any  Internet 
transaction  that  is  identified  and  segregated  pursuant  to  subsection 
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3  (b)(4)  a.  and  is  subsequently  determined  to  contain  a  discrete 
communication  as  to  which  tire  sender  and  all  intended  recipients  are 
reasonably  believed  to  be  located  in  the  United  States  will  be  handled  in 
accordance  with  Section  5  below. 

(b)  (U//FOUQ)  Any  information  moved  or  copied  from  the  segregated 
repository  into  repositories  more  generally  accessible  to  NS  A  analysts  will 
be  handled  in  accordance  with  subsection  3(b)(4)b.  below  and  the  other 
applicable  provisions  of  these  procedures. 

(c)  (U//FQUO)  Any  information  moved  or  copied  from  the  segregated 
repository  into  repositories  more  generally  accessible  to  NS  A  analysts  will 
be  marked,  tagged,  or  otherwise  identified  as  having  been  previously 
segregated  pursuant  to  subsection  3(b)(4)a. 

3.  (TS/ZSIYNP)-  Internet  transactions  that  are  not  identified  and  segregated 

pursuant  to  subsection  3(b)(4)a,  will  be  handled  in  accordance  with  subsection 
3(b)(4)b.  below  and  the  other  applicable  provisions  of  these  procedures. 

b.  (U),  NSA  analysts  seeking  to  use  (for  example,  in  a  FISA  application,  intelligence 
report,  or  section  702  targeting)  a  discrete  communication  within  an  Internet 
transaction  that  contains  multiple  discrete  communications  will  assess  whether  the 
discrete  communication:  1)  is  a  communication  as  to  which  the  sender  and  all 
intended  recipients  are  located  in  the  United  States;  and  2)  is  to,  from,  or  about  a 
tasked  selector,  or  otherwise  contains  foreign  intelligence  information. 

1.  (TS//SF/NF)  If  an  NSA  analyst  seeks  to  use  a  discrete  commimication  within 
an  Internet  transaction  that  contains  multiple  discrete  communications,  the 
analyst  wdll  first  perfoiTn  checks  to  deteimine  the  locations  of  the  sender  and 
intended  recipients  of  that  discrete  communication  to  the  extent  reasonably 
necessary  to  determine  whether  the  sender  and  all  intended  recipients  of  that 
communication  ai'e  located  in  the  United  States.  If  an  analyst  determines  that 
the  sender  and  all  intended  recipients  of  a  discrete  communication  within  an 
Internet  transaction  are  located  in  the  United  States,  the  Internet  transaction 
will  be  handled  in  accordance  with  Section  5  below. 

2.  (U)  If  an  NSA  analyst  seeks  to  use  a  discrete  communication  within  an 
Internet  transaction  that  contains  multiple  discrete  communications,  the 
analyst  will  assess  whether  the  discrete  communieation  is  to,  from,  or  about  a 
tasked  selector,  Or  otherwise  contains  foreign  intelligence  information. 

(a)  (U)  If  the  discrete  communication  is  to,  from,  or  about  a  tasked  selector, 
any  U.S.  person  information  in  that  communication  will  be  handled  in 
accordance  with  the  applicable  provisions  of  these  procedures. 
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(b)  (U)  If  the  discrete  communication  is  not  to,  from,  or  about  a  tasked 
selector  but  otherwise  contains  foreign  intelligence  information,  and  the 
discrete  communication  is  not  to  or  from  an  identifiable  U.S.  person  or  a 
person  reasonably  believed  to  be  located  in  the  United  States,  that 
communication  (including  any  U.S.  person  infomiation  therein)  will  be 
handled  in  accordance  with  the  applicable  provisions  of  these  procedures. 

(c)  (U)  If  the  discrete  communication  is  not  to,  from,  or  about  a  tasked 
selector  but  is  to  or  from  an  identifiable  U.S.  person,  or  a  person 
reasonably  believed  to  be  located  in  the  United  States,  the  NS  A  analyst 
will  document  that  determination  in  the  relevant  analytic  repository  or  tool 
if  technically  possible  or  reasonably  feasible.  Such  discrete 
communication  cannot  be  used  for  any  purpose  other  than  to  protect 
against  an  immediate  threat  to  human  life  (e.g.,  force  protection  or  hostage 
situations).  NSA  will  report  any  such  use  to  the  Office  of  the  Director  of 
National  Intelligence  and  to  the  National  Security  Division  of  the 
Department  of  Justice,  which  will  promptly  notify  the  Foreign  Intelligence 
Surveillance  Court  of  such  use. 

3 .  (TS/ZSk/NF)  An  NSA  analyst  seeking  to  use  a  discrete  communication  within 
an  Internet  transaction  that  contams  multiple  discrete  communications  in  a 
FISA  application,  intelligence  report,  or  section  702  targeting  must 
appropriately  document  the  verifications  required  by  subsections  3(b)(4)b.l. 
and  2.  above. 

4.  (TS/ZSk/NF)-  Notwithstanding  subsection  3(b)(4)b.  above,  NSA  may  use 
metadata  extracted  from  hitemet  transactions  acquired  on  or  after  October  31, 
2011,  that  are  not  identified  and  segi'egated  pursuant  to  subsection  3(b)(4)a. 
without  first  assessing  whether  the  metadata  was  extracted  from:  a)  a  discrete 
communication  as  to  which  the  sender  and  all  intended  recipients  are  located 
in  tlie  United  States;  orb)  a  discrete  communication  to,  from,  or  about  a 
tasked  selector.  Any  metadata  extracted  from  Internet  transactions  that  are  not 
identified  and  segregated  pursuant  to  subsection  3(b)(4)a.  above  will  be 
handled  in  accordance  with  the  applicable  provisions  of  these  procedures. 

Any  metadata  extracted  from  an  Internet  transaction  subsequently  detennined 
to  contain  a  discrete  commimication  as  to  which  the  sender  and  all  intended 
recipients  are  reasonably  believed  to  be  located  inside  the  United  States  shall 
be  destroyed  upon  recognition. 

(5)  (U)  Magnetic  tapes  or  other  storage  media  containing  communications  acquired 
pursuant  to  section  702  may  be  scanned  by  computer  to  identify  and  select 
communications  for  analysis.  Computer  selection  terms  used  for  scanning,  such  as 
telephone  numbers,  key  words  or  phrases,  or  other  discriminators,  will  be  limited  to 
those  selection  terms  reasonably  likely  to  return  foreign  intelligence  information. 
Identifiers  of  an  identifiable  U.S.  person  may  not  be  used  as  terms  to  identify  and 
select  for  analysis  any  Internet  communication  acquired  through  NS  A's  upstream 
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collection  techniques.  An}"^  use  of  United  States  person  identifiers  as  terms  to  identify 
and  select  communications  must  first  be  approved  in  accordance  with  NSA 
procedures.  NSA  will  maintain  records  of  all  United  States  person  identifiers 
approved  for  use  as  selection  teims.  The  Depaitment  of  Justice's  National  Security 
Division  and  the  Office  of  the  Director  of  National  Intelligence  will  conduct  oversigirt 
of  NSA's  activities  with  respect  to  United  States  persons  that  are  conducted  pursuant 
to  this  paragraph. 

(6)  (U)  Further  handling,  retention,  and  dissemination  of  foreign  communications  will  be 
made  in  accordance  with  Sections  4,  6,  7,  and  8  as  applicable,  below.  Further 
handling,  storage,  and  dissemination  of  inadvertently  acquired  domestic 
communications  will  be  made  in  accordance  with  Sections  4,  5,  and  8  below. 

(c)  (U)  Destruction  of  Raw  Data 

(1) -tS//S: _ 

communications  acquired  by  or  with  the  assistance  of  the  FBI  fi:om  Internet  Service 
Providers  that  do  not  meet  the  retention  standards  set  forth  in  tlrese  procedures  and 
that  are  known  to  contain  communications  of  or  concerning  United  States  persons 
will  be  destroyed  upon  recognition.  Telephony  communications  and  Internet 
communications  acquired  by  or  with  the  assistance  of  the  FBI  from  hitemet  Service 
Providers  may  not  be  retained  longer  than  five  years  from  the  expiration  date  of  the 
certification  authorizing  the  collection  unless  NSA  specifically  detennines  that  each 
such  communication  meets  the  retention  standards  in  these  procedures. 

(2)  (TS//SF/NF)  Internet  transactions  acquired  tlirougli  NSA's  upstream  collection  ■ 
techniques  that  do  not  contain  any  information  that  meets  the  retention  standards  set 
forth  in  these  procedures  and  that  are  known  to  contain  communications  of  or 
concerning  United  States  persons  will  be  destroyed  upon  recognition.  An  Internet 
transaction  may  not  be  retained  longer  than  two  years  from  the  expiration  date  of  the 
certification  authorizing  the  collection  unless  NSA  specifically  determines  that  at 
least  one  discrete  communication  within  the  Internet  transaction  meets  the  retention 
standards  in  these  procedures  and  that  each  discrete  communication  within  the 
transaction  either:  (a)  is  to,  from,  or  about  a  tasked  selector;  or  (b)  is  not  to,  from,  or 
about  a  tasked  selector  and  is  also  not  to  or  from  an  identifiable  United  States  person 
or  person  reasonably  believed  to  be  in  the  United  States.  The  Internet  transactions 
that  may  be  retained  include  those  that  were  acquired  because  of  limitations  on  NSA's 
ability  to  filter  communications.  Any  hitemet  commmiications  acquired  tlirough 
NSA's  upstream  collection  techniques  that  are  retained  in  accordance  with  this 
subsection  may  be  reviewed  and  handled  only  in  accordance  with  the  standards  set 
forth  above  in  subsection  3(b)(4)  of  these  procedures. 

(3) -(TS//SF/NF)  Any  Internet  transactions  acquired  through  NSA's  upstream  collection 
techniques  prior  to  October  31,  201 1,  will  be  destroyed  upon  recognition. 


Pelephony  communications  and  hitemet 
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(4)  (S/I'-TF)  NSA  may  temporarily  retain  specific  section  702-acquired  infonnation  that 
would  otherwise  have  to  be  destroyed,  pursuant  to  section  3(a)-(c)  above,  if  the 
Department  of  Justice  advises  NSA  in  writing  that  such  information  is  subject  to  a 
preservation  obligation  in  pending  or  anticipated  administrative,  civil,  or  criminal 
litigation.  The  specific  information  to  be  retained  (including,  but  not  limited  to,  the 
target(s)  or  selector(s)  whose  unminimized  infonnation  must  be  preserved  and  the 
relevant  time  period  at  issue  in  the  litigation),  and  the  particulai-  litigation  for  which 
the  information  will  be  retained,  shall  be  identified  in  writing  by  the  Department  of 
Justice.  Personnel  not  working  on  the  particular  litigation  matter  shall  not  access  tlie 
unminimized  section  702-acquired  information  preserved  pursuant  to  a  written 
preservation  notice  fiom  the  Department  of  Justice  that  would  otherwise  have  been 
destroyed  pursuant  to  these  procedures.  Other  personnel  shall  only  access  the 
infonnation  being  retained  for  litigation-i'elated  reasons  on  a  case-by-case  basis  after 
consultation  with  the  Department  of  Justice.  The  Department  of  Justice  shall  notify 
NSA  in  writing  once  the  section  702-acquired  infonnation  is  no  longer  required  to  be 
preserved  for  such  litigation  matters,  and  then  NSA  shall  promptly  destroy  the  section 
702-acquired  infonnation  as  otherwise  required  by  these  procedures.  Circumstances 
could  arise  requiring  that  section  702-acquired  infoimation  subject  to  other 
destruction/age  off  requirements  in  these  procedures  (e.g..  Section  5)  be  retained 
because  it  is  subject  to  a  preservation  requirement.  In  such  cases  the  Government 
will  notify  the  Foreign  Intelligence  Surveillance  Court  and  seek  permission  to  retain 
the  material  as  appropriate  consistent  with  law.  Depending  on  the  nature,  scope  and 
complexity  of  a  particular  preservation  obligation,  m  certain  circumstances  it  may  be 
technically  infeasible  to  retain  certain  section  702-acquired  information.  Should  such 
circumstances  arise,  they  will  be  brought  to  the  attention  of  the  court  with  jurisdiction 
over  the  underlying  litigation  matter  for  resolution. 

(d)  (U)  Change  in  Target's  Location  or  Status 

(1)  (U//FOUQ)  In  the  event  that  NSA  reasonably  believes  that  a  target  is  located  outside 
the  United  States  and  subsequently  learns  that  the  person  is  inside  the  United  States, 
or  if  NSA  concludes  that  a  target  who  at  the  time  of  targeting  was  believed  to  be  a 
non-United  States  person  is  in  fact  a  United  States  person  at  the  time  of  acquisition, 
the  acquisition  from  tlrat  person  will  be  tenninated  without  delay. 

(2)  (U)  Any  communications  acquired  through  the  targeting  of  a  person  who  at  the  time 
of  targeting  was  reasonably  believed  to  be  located  outside  the  United  States  but  is  in 
fact  located  inside  the  United  States  at  the  time  such  communications  were  acquired, 
and  any  communications  acquired  by  targeting  a  pei'son  who  at  the  time  of  targeting 
was  believed  to  be  a  non-United  States  person  but  was  in  fact  a  United  States  person 
at  the  time  such  communications  were  acquired,  will  be  treated  as  domestic 
communications  mider  these  procedures. 

(e)  (S//NF)  In  tlie  event  that  NSA  seeks  to  use  any  information  acquired  pursuant  to  section 

nty  about  the  location  of  the  target  of  tlie 
cheeks  described  in  NSA’s  seetion  702 


702  during  a  tune  perio^whaUhere  is  uncertai 


aequisition  beeause  the 


Dost-tasking 
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targeting  procedures  were  not  functioning  properly,  NSA  will  follow  its  internal 
procedures  for  detennining  whether  such  information  may  be  used  (including,  but  not 
limited  to,  in  FISA  applications,  section  702  targeting,  and  disseminations).  Except  as 
necessary  to  assess  location  under  this  provision,  NSA  may  not  use  or  disclose  any 
information  acquned  pursuant  to  section  702  during  such  time  period  unless  NSA 
determines,  based  on  the  totality  of  the  circumstances,  that  the  tai-get  is  reasonably 
believed  to  have  been  located  outside  the  United  States  at  the  time  the  information  was 
acquned.  If  NSA  determines  that  the  target  is  reasonably  believed  to  have  been  located 
inside  the  United  States  at  the  time  the  infonnation  was  acquired,  such  information  will 
not  be  used  and  will  be  promptly  destroyed. 

(U)  Section  4  -  Acquisition  and  Handling  -  Attorney-Client  Communications 

(U)  As  soon  as  it  becomes  apparent  that  a  cormnunication  is  between  a  person  who  is  kirown 
to  be  under  criminal  indictment  in  the  United  States  and  an  attorney  who  represents  that 
individual  in  the  matter  under  indictment  (or  someone  acting  on  behalf  of  the  attorney), 
monitoring  of  that  communication  will  cease  and  the  communication  will  be  identified  as  an 
attorney-client  communication  m  a  log  maintained  for  that  purpose.  The  relevant  portion  of 
the  communication  containing  that  conversation  will  be  segregated  and  the  National  Security 
Division  of  the  Department  of  Justice  will  be  notified  so  that  appropriate  procedures  may  be 
established  to  protect  such  communications  fi'om  review  or  use  in  any  criminal  prosecution, 
while  preserving  foreign  intelligence  infonnation  contained  thereui.  Additionally,  all 
proposed  disseminations  of  information  constituting  United  States  person  attorney-client 
privileged  communications  must  be  reviewed  by  the  NSA  Office  of  General  Counsel  prior  to 
dissemination, 

(U)  Section  5  -  Domestic  Communications 

(TS//SI//NF)  A  communication  identified  as  a  domestic  communication  (and,  if  applicable, 
the  Internet  transaction  in  wliich  it  is  contained)  will  be  promptly  destroyed  upon  recognition 
unless  the  Director  (or  Acting  Director)  of  NSA  specifically  determines,  in  writing  and  on  a 
coromunication-by-communication  basis,  that  the  sender  or  intended  recipient  of  tlie 
domestic  communication  had  been  properly  targeted  under  section  702  of  the  Act,  and  the 
domestic  communication  satisfies  one  or  more  of  the  following  conditions: 

(1)  (TS//SI//NF)  such  domestic  communication  is  reasonably  believed  to  contain 
significant  foreign  intelligence  information.  Such  domestic  communication  (and,  if 
applicable,  the  transaction  in  which  it  is  contauied)  may  be  retained,  handled,  and 
disseminated  in  accordance  with  these  procedures; 

(2)  (TS/ZSIZ/NF)  such  domestic  communication  does  not  contain  foreign  intelligence 
information  but  is  reasonably  believed  to  contain  evidence  of  a  crime  that  has  been,  is 
being,  or  is  about  to  be  committed.  Such  domestic  communication  may  be 
disseminated  (including  United  States  person  identities)  to  appropriate  Federal  law 
enforcement  authorities,  in  accordance  with  50  U.S.C.  §§  1806(b)  and  1825(c), 
Executive  Order  No.  12333,  and,  where  applicable,  the  crimes  reporting  procedures 
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set  out  in  the  August  1995  "Memorandum  of  Understanding:  Reporting  of 
Information  Concerning  Federal  Crimes,"  or  any  successor  docmnent.  Such  domestic 
communication  (and,  if  applicable,  the  transaction  in  winch  it  is  contained)  may  be 
retained  by  NS  A  for  a  reasonable  period  of  time,  not  to  exceed  six  months  unless 
extended  in  writing  by  the  Attorney  General,  to  pennit  law  enforcement  agencies  to 
determine  whether  access  to  original  recordings  of  such  communication  is  required 
for  law  enforcement  purposes; 

(3)  (TS//SI//NF)  such  domestic  communication  is  reasonably  believed  to  contain 
technical  data  base  information,  as  defined  in  Section  2(j),  or  infonnation  necessary 
to  understand  or  assess  a  communications  security  vulnerability.  Such  domestic 
communication  maybe  provided  to  the  FBI  and/or  disseminated  to  other  elements  of 
the  United  States  Government.  Such  domestic  communication  (and,  if  applicable,  the 
transaction  in  which  it  is  contained)  may  be  retained  for  a  period  sufficient  to  allow  a 
thorough  exploitation  and  to  pennit  access  to  data  that  is,  or  is  reasonably  believed 
likely  to  become,  relevant  to  a  current  or  future  foreign  intelligence  requirement. 
Sufficient  duration  may  vary  witla  the  nature  of  the  exploitation. 

a.  (U//TQUO)  In  the  context  of  a  cryptanalytic  effort,  maintenance  of  technical  data 
bases  requires  retention  of  all  communications  that  are  enciphered  or  reasonably 
believed  to  contain  secret  meaning,  and  sufficient  duration  may  consist  of  any 
period  of  time  during  which  encrypted  material  is  subject  to,  or  of  use  in, 
cryptanalysis. 

b.  the  case  of  communications  tliat  are  not 
enciphered  or  otherwise  reasonably  believed  to  contain  searet  meaning,  sufficient 
duration  is  five  years  from  expiration  date  of  the  certification  authorizing  the 
collection  for  telephony  communications  and  Internet  communications  acquired 
by  or  with  the  assistance  of  the  FBI  from  Internet  Service  Providers,  and  two 
years  firom  expiration  date  of  the  ceitifi  cation  authorizing  the  collection  for 
Internet  transactions  acquired  through  NS  A’s  upstream  collection  techniques, 
unless  the  Signal  Intelligence  Director,  NS  A,  determines  in  writing  that  retention 
of  a  specific  communication  for  a  longer  period  is  required  to  respond  to 
authorized  foreign  intelligence  or  counterintelligence  requirements;  or 

(4)  (U//FQUQ)  such  domestic  commmiication  contains  information  pertaining  to  an 
imminent  threat  of  serious  harm  to  life  or  property.  Such  information  may  be 
retained  and  disseminated  to  the  extent  reasonably  necessary  to  counter  such  threat. 

(S//NF)  Notwithstanding  the  above,  if  a  domestic  communication  indicates  that  a  target 
has  entered  the  United  States,  NS  A  may  promptly  notify  the  FBI  of  that  fact,  as  well  as 
any  information  concerning  the  target’s  location  that  is  contained  in  the  communication. 
NSA  may  also  use  information  derived  from  domestic  communications  for  collection 
avoidance  purposes,  and  may  provide  such  infoimation  to  the  FBI  and  CIA  for  collection 
avoidance  purposes.  NSA  may  retain  the  communication  from  which  such  infonnation  is 
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derived  but  shall  restrict  the  further  use  or  dissemination  of  the  communication  by 
placing  it  on  the  Master  Purge  List  (MPL). 

(U)  Section  6  -  Foreign  Communications  of  or  Concerning  United  States  Persons 
(a)  (U)  Retention 

(U)  Foreign  communications  of  or  concerning  United  States  persons  collected  in  the  course 
of  an  acquisition  authorized  under  section  702  of  the  Act  may  be  retained  only: 

(1)  (U)  if  necessary  for  the  maintenance  of  technical  data  bases.  Retention  for  this 
purpose  is  permitted  for  a  period  sufficient  to  allow  a  thorough  exploitation  and  to 
permit  access  to  data  that  are,  or  are  reasonably  believed  likely  to  become,  relevant  to 
a  current  or  future  foreign  intelligence  requirement.  Sufficient  duration  may  vary 
with  the  nature  of  the  exploitation. 

a.  (U)  In  the  context  of  a  cryptanalytic  effort,  maintenance  of  technical  data  bases 
requires  retention  of  all  communications  that  are  enciphered  or  reasonably 
believed  to  contain  secret  meaning,  and  sufficient  duration  may  consist  of  any 
period  of  time  during  which  encrypted  material  is  subject  to,  or  of  use  in, 
cryptanalysis. 

b.  (TS//SI//NF)  In  the  case  of  communications  that  are  not  enciphered  or  otherwise 
reasonably  beheved  to  contain  secret  meaning,  sufficient  duration  is  five  years 
from  expiration  date  of  the  certification  authorizing  the  collection  for  telephony 
communications  and  Internet  communications  acquired  by  or  with  the  assistance 
of  the  FBI  from  Internet  Service  Providers,  and  two  years  fi’om  expiration  date  of 
the  certification  authorizing  the  collection  for  Internet  transactions  acquired 
through  NSA's  upstream  collection  techniques,  unless  the  Signals  Intelligence 
Director,  NS  A,  determines  in  writing  that  retention  of  a  specific  category  of 
communications  for  a  longer  period  is  required  to  respond  to  authorized  foreign 
intelhgeiice  or  counterintelligence  requirements; 

(2)  (U)  if  dissemination  of  such  communications  with  reference  to  such  United  States 
persons  would  be  permitted  under  subsection  (b)  below;  or 

(3)  (U)  if  the  information  is  evidence  of  a  crime  that  has  been,  is  being,  or  is  about  to  be 
committed  and  is  provided  to  appropriate  federal  law  enforcement  authorities. 

(TS//SI//NF)  Forei^  communications  of  or  concerning  United  States  persons  that  may 
be  retained  under  subsections  6(a)(2)  and  (3)  above  include  discrete  communications 
contained  in  Interaet  transactions,  provided  that  NSA  has  specifically  determined, 
consistent  with  subsection  3(c)(2)  above,  that  each  discrete  communication  within  the 
Internet  transaction  either:  (a)  is  to,  from,  or  about  a  tasked  selector;  or  (b)  is  not  to,  from, 
or  about  a  tasked  selector  and  is  also  not  to  or  from  an  identifiable  United  States  person 
or  person  reasonably  believed  to  be  in  the  United  States. 
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(b)  (U)  Dissemination 

(U)  A  dissemination  based  on  communications  of  or  concerning  a  United  States  person  may 
be  made  in  accordance  with  Section  7  or  8  below  if  the  identity  of  the  United  States  person  is 
deleted  and  a  generic  teiin  or  s3nnbol  is  substituted  so  that  the  information  cannot  reasonably 
be  connected  with  an  identifiable  United  States  person.  Otherwise,  dissemination  of 
intelligence  based  on  communications  of  or  concerning  a  United  States  person  may  only  be 
made  to  a  recipient  requiring  the  identity  of  such  person  for  the  performance  of  official  duties 
but  only  if  at  least  one  of  the  following  criteria  is  also  met: 

(1)  (U)  tlie  United  States  person  has  consented  to  dissemination  or  the  infonnation  of  or 
concerning  the  United  States  person  is  available  publicly; 

(2)  (U)  the  identity  of  the  United  States  person  is  necessary  to  understand  foreign 
intelligence  information  or  assess  its  importance,  e.g.,  the  identity  of  a  senior  official 
in  the  Executive  Branch; 

(3)  (U)  the  conununication  or  information  indicates  that  the  Urdted  States  person  may  be: 

a.  an  agent  of  a  foreign  power; 

b.  a  foreign  power  as  defined  in  section  101(a)  of  the  Act; 

c.  residing  outside  the  United  States  and  holding  an  official  position  in  the 
government  or  military  forces  of  a  foreign  power; 

d.  a  coiporation  or  other  entity  that  is  owned  or  controlled  directly  or  indirectly  by  a 
foreign  power;  or 

e.  acting  in  collaboration  with  an  intelligence  or  security  service  of  a  foreign  power 
and  the  United  States  person  has,  or  has  had,  access  to  classified  national  security 
information  or  material; 

(4)  (U)  the  communication  or  information  indicates  that  the  United  States  person  may  be 
the  target  of  intelligence  activities  of  a  foreign  power; 

(5)  (U)  the  communication  or  infonnation  indicates  that  the  United  States  person  is 
engaged  in  the  unauthorized  diselosure  of  classified  national  security  information  or 
the  United  States  person's  identity  is  necessary  to  understand  or  assess  a 
communications  or  network  security  vulnerability,  but  only  after  the  agency  that 
originated  the  information  certifies  that  it  is  properly  classified; 

(6)  (U)  the  communication  or  information  indicates  that  the  United  States  person  may  be 
engaging  in  international  terrorist  activities; 
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(7)  (U//FOUQ)  the  acquisition  of  the  United  States  person's  communication  was 
authorized  by  a  court  order  issued  pursuant  to  the  Act  and  the  communication  may 
relate  to  the  foreign  intelligence  purpose  of  the  suiweillance;  or 

(8)  (U)  the  communication  or  information  is  reasonably  believed  to  contain  evidence  that 
a  crime  has  been,  is  being,  or  is  about  to  be  committed,  provided  that  dissemination  is 
for  law  enforcement  purposes  and  is  made  in  accordance  with  50  U.S.C.  §§  1 806(b) 
and  1825(c),  Executive  Order  No.  12333,  and,  where  applicable,  the  crimes  reporting 
procedures  set  out  in  the  August  1995  "Memorandmn  of  Understanding:  Reporting  of 
Information  Concerning  Federal  Grumes,"  or  any  successor  document. 

(c)  (U)  Provision  of  Unminimized  Communications  to  CIA  and  FBI 

(1)  (U)  NSA  may  provide  to  the  Central  Intelligence  Agency  (CIA)  unminimized 
communications  acquired  pursuant  to  section  702  of  the  Act.  CIA  will 
identify  to  NSA  targets  for  which  NSA  may  provide  umninimized 
communications  to  CIA.  CIA  will  handle  any  such  umminunized 
communications  received  from  NSA  in  accordance  with  CIA  minimization 
procedui'es  adopted  by  the  Attorney  General,  in  consultation  with  the  Director 
of  National  Intelligence,  pursuant  to  subsection  702(e)  of  the  Act. 

(2)  (U)  NSA  may  provide  to  the  FBI  unminimized  communications  acquired  pursuant  to 
section  702  of  the  Act.  The  FBI  will  identify  to  NSA  targets  for  which  NSA  may 
provide  unminimized  communications  to  the  FBI.  The  FBI  will  handle  any  such 
unminimized  communications  received  from  NSA  in  accordance  with  FBI 
minimization  procedures  adopted  by  tire  Attorney  General,  in  consultation  with  the 
Director  of  National  Intelligence,  pursuant  to  subsection  702(e)  of  the  Act. 

(U)  Section  7  -  Other  Foreign  Communications 

(U)  Foreign  communications  of  or  concerning  a  non-United  States  person  may  be  retained, 
used,  and  disseminated  in  any  form  in  accordance  witli  other  applicable  law,  regulation,  and 
policy. 


communications  of  or  concerning  a  non-United  States  person  drat  may 


be  retained  under  this  subsection  include  discrete  communications  contamed  in  Internet 
transactions,  provided  that  NSA  has  specifically  detennined,  consistent  with  subsection 
3(c)(2)  above,  that  each  discrete  communication  within  the  Internet  transaction  either:  (a)  is 
to,  from,  or  about  a  tasked  selector;  or  (b)  is  not  to,  from,  or  about  a  tasked  selector  and  is 
also  not  to  or  from  an  identifiable  United  States  person  or  person  reasonably  believed  to  be  in 
the  United  States. 

(U//FOUO)-  Additionally,  foreign  communications  of  or  concerning  a  non-United  States 
person  may  be  retained  for  the  same  purposes  and  in  the  same  manner  as  detailed  in  Section 
6(a)(1),  above. 
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(U)  Section  8  -  Collaboration  with  Foreign  Governments 

(a)  (U)  Procedures  for  the  dissemination  of  evaluated  and  minimized  information.  Pursuant 
to  section  1.7(c)(8)  of  Executive  Order  No.  12333,  as  amended,  NSA  conducts  foreign 
cryptologic  liaison  relationships  with  certain  foreign  governments.  Information  acquired 
pursuant  to  section  702  of  the  Act  may  be  disseminated  to  a  foreign  government.  Except 
as  provided  below  in  subsection  8(b)  of  these  procedures,  any  dissemination  to  a  foreign 
government  of  information  of  or  concerning  a  United  States  person  that  is  acquired 
pursuant  to  section  702  may  only  be  done  in  a  manner  consistent  with  sections  6(b)  and  7 
of  these  NSA  minimization  procedures. 

(b)  (U)  Procedures  for  teclmical  or  linguistic  assistance.  It  is  anticipated  that  NSA  may 
obtain  information  or  communications  that,  because  of  their  technical  or  linguistic 
content,  may  require  further  analysis  by  foreign  governments  to  assist  NSA  in 
determining  their  meaning  or  significance.  Notwithstanding  other  provisions  of  these 
minimization  procedures,  NSA  may  disseminate  computer  disks,  tape  recordings, 
transcripts,  or  other  information  or  items  containing  unminimized  information  or 
communications  acquired  pursuant  to  section  702  to  foreign  governments  for  further 
processing  and  analysis,  under  the  following  restrictions  with  respect  to  any  materials  so 
disseminated; 

(1)  (U)  Dissemination  to  foreign  governments  will  be  solely  for  translation  or 
analysis  of  such  infonnation  or  communications,  and  assisting  foreign 
governments  will  make  no  use  of  any  information  or  any  communication  of  or 
concerning  any  person  except  to  provide  technical  and  linguistic  assistance  to 
NSA. 

(2)  (U)  Dissemination  will  be  only  to  those  persoimel  within  foreign  goveimnents 
involved  in  the  translation  or  analysis  of  such  information  or  cormnunications. 

The  number  of  such  personnel  will  be  restricted  to  the  extent  feasible.  There 
will  be  no  dissemination  witliin  foreign  governments  of  this  umninimized  data. 

(3)  (U)  Foreign  governments  will  make  no  permanent  agency  record  of 
hiformation  or  communications  of  or  concerning  any  person  refeined  to  or 
recorded  on  computer  disks,  tape  recordings,  transcripts,  or  other  items 
disseminated  by  NSA  to  foreign  governments,  provided  that  foreign 
goveimnents  may  maintain  such  temporary  records  as  are  necessary  to  enable 
them  to  assist  NSA  with  the  translation  or  analysis  of  such  information. 

Records  maintained  by  foreign  governments  for  this  purpose  may  not  be 
disseminated  within  the  foreign  governments,  except  to  personnel  involved  in 
providing  technical  or  linguistic  assistance  to  NSA. 

(4)  (U)  Upon  the  conclusion  of  such  technical  or  linguistic  assistance  to  NSA, 
computer  disks,  tape  recordings,  transcripts,  or  other  items  or  information 
disseminated  to  foreign  goveimnents  will  either  be  retmned  to  NSA  or  be 
destroyed  with  an  accounting  of  such  destruction  made  to  NSA. 
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(5)  (U)  Any  information  tliat  foreign  governments  provide  to  NS  A  as  a  result  of 
such  technical  or  linguistic  assistance  may  be  disseminated  by  NSA  in 
accordance  with  these  minimization  procedures. 
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ABSTRACT 

The  Border  Gateway  Protocol  propagates  routing  informa¬ 
tion  accross  the  Internet  in  an  incremental  manner.  It  only 
advertises  to  its  peers  changes  in  routing.  However,  as  early 
as  1998,  observations  have  been  made  of  BGP  announcing 
the  same  route  multiple  times,  causing  router  CPU  load, 
memory  usage  and  convergence  time  higher  than  expected. 

In  this  paper,  by  performing  controlled  experiments,  we 
pinpoint  multiple  causes  of  duplicates,  ranging  from  the  lack 
of  full  RIB-Outs  to  the  discrete  processing  of  update  mes¬ 
sages.  To  mitigate  these  duplicates,  we  insert  a  cache  at 
the  output  of  the  routers.  We  test  it  on  public  BGP  traces 
and  discuss  the  relation  of  the  cache  performance  with  the 
existence  of  bursts  of  updates  in  the  trace. 

1.  INTRODUCTION 

The  Border  Gateway  Protocol  [1]  (BGP)  is  the  de  facto 
standard  used  to  exchange  inter- AS  routing  information  on 
the  Internet.  Its  correct  and  scalable  behavior  is  critical  to 
the  operation  of  the  Internet.  One  of  the  keys  to  BGP  scala¬ 
bility  is  the  use  of  incremental  routing  updates:  only  changes 
in  destination  prefix  reachability  are  advertised.  These  chan¬ 
ges  include  the  reachability  of  a  new  prefix,  the  unreachabil¬ 
ity  of  an  existing  destination  (withdrawal),  or  a  modification 
of  the  path  attributes  associated  with  a  destination.  Path 
attributes  are  involved  in  routing  decisions  and  also  ensure 
proper  protocol  behavior  such  as  avoiding  routing  loops.  Ac¬ 
cording  to  the  protocol  specification,  a  BGP  speaker  should 
not  issue  an  update  containing  the  same  BGP  information 
as  was  most  recently  advertised  for  the  prefix. 

Anomalous  BGP  behavior  has  been  observed  as  early  as 
1998  [2].  Based  on  a  9  months  trace  of  the  BGP  traffic  ex¬ 
changed  between  backbone  networks,  Labovitz  et  al.  showed 
lack  of  aggregation  and  high  routing  instability  with  up  to 
99%  of  exchanged  routing  information  not  being  related 
to  topological  changes.  In  particular,  they  observed  the 
occurrence  of  redundant  BGP  update  messages  that  they 
called  duplicate  updates.  At  that  time,  most  of  the  dupli¬ 
cates  where  due  to  bogus  stateless  BGP  implementations. 
The  authors  noted  that  the  observed  high  level  of  instabil¬ 
ity  was  detrimental  to  the  operations  of  the  Internet,  caus¬ 
ing  high  router  CPU  load,  making  routers  unresponsive  and 
in  the  worst  cases  leading  to  packet  or  routing  information 
losses.  In  addition,  they  may  sometimes  trigger  unreacha¬ 
bility  when  interacting  with  route  flap  damping  [3]. 

*David  started  this  work  during  his  internship  at  IIJ. 
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Several  studies  later  revisited  BGP  dynamics  [4-8]  and 
its  impact  on  router  CPU  load  [9],  some  focused  on  BGP 
duplicates.  Although  the  number  of  pathological  updates 
declined  over  time,  duplicates  still  constitute  a  significant 
part  of  the  BGP  traffic  with  up  to  15%  of  the  updates  ob¬ 
served  at  RIPE  monitors  in  2006  [5].  It  was  later  shown 
that  the  duplicate  problem  is  even  worse  for  routers  in  the 
core  of  the  Internet  with  the  portion  of  duplicates  varying 
from  7%  to  60%  in  2008  [7].  More  recently,  in  2009,  Park 
et  al.  [6]  studied  over  90  RouteViews/RIPE  monitors  and 
showed  that  the  duplicates  make  up  13.5%  of  the  aggregated 
BGP  traffic.  Routers  can  receive  up  to  86.4%  of  duplicates 
during  their  busiest  time.  These  previous  works  show  that 
duplicates  are  a  continuing  problem.  We  confirm  this  ob¬ 
servation  by  looking  at  all  sessions  from  EQUINIX,  ISC, 
LINX  and  WIDE  RouteViews  collectors  from  2009  to  2014. 
48.5%  of  the  traces  we  observed  had  more  than  10%  of  du¬ 
plicates.  The  traces  also  display  a  high  variability  with  an 
average  of  (18.84  ±  22.31)%  duplicates.  Finally,  [6]  hinted 
that  a  change  in  attributes  attached  to  iBGP  routes  may 
trigger  eBGP  duplicates.  To  the  best  of  our  knowledge,  so 
far,  no  thorough  study  has  explained  their  origin  or  tried  to 
mitigate  the  problem. 

In  this  paper,  we  make  the  following  contributions: 

•  We  discuss  in  Section  2  the  causes  of  today’s  dupli¬ 
cates.  Although  the  majority  of  duplicates  in  1998 
were  bogus  route  withdrawals,  this  is  not  the  case 
today  (less  than  0.5%  on  almost  all  traces).  To  un¬ 
derstand  what  causes  duplicates,  we  inject  carefully 
crafted  BGP  updates  into  a  router  and  we  correlate  the 
input  and  output  BGP  traffic.  Based  on  this,  we  iden¬ 
tify  different  causes  for  duplicates.  Most  duplicates 
today  are  due  to  implementions  trading  off  between 
memory  footprint  and  statefulness. 

•  In  Section  3,  we  devise  a  caching  mechanism  that  mit¬ 
igates  duplicates.  The  benefit  of  using  a  cache  is  that 
the  amount  of  memory  used  can  be  controlled.  We 
evaluate  the  efficiency  of  our  caching  mechanism  on 
several  real  world  BGP  traces,  using  several  replace¬ 
ment  strategies.  We  show  that  our  cache  significantly 
reduces  duplicates  for  prefixes  in  the  default  free  zone 
even  with  a  small  cache  size. 

2.  THE  ORIGIN  OF  DUPLICATES 

To  investigate  the  origin  of  BGP  duplicates,  we  follow  two 
different  approaches.  First  we  look  at  a  router  that  receives 
live  BGP  feeds.  We  capture  all  the  BGP  traffic  and  we  man- 
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ually  correlate  duplicates  observed  in  the  outbound  traffic 
with  messages  in  the  inbound  traffic.  This  is  an  approach 
similar  to  that  used  by  Park  et  al.  in  [6]  that  gives  us  some 
initial  insight  on  potential  causes  for  duplicates. 

Second,  we  perform  a  fully  controlled  experiment  where 
we  inject  crafted  sequences  of  messages  into  a  test  router. 
We  then  look  for  duplicates  in  the  output  messages.  Our 
experiment  allows  to  confirm  the  hypotheses  of  Park  et  al. 
on  the  origin  of  duplicates.  We  also  go  much  further  as  we 
establish  three  additional  causes  for  duplicates. 

This  section  explains  our  methodology  and  subsequent  ob¬ 
servations. 

2.1  Definitions 

We  dehne  a  duplicate  as  a  redundant  prefix  advertise¬ 
ment  with  the  same  attributes  as  the  most  recent  update 
for  this  prehx  on  the  same  session  and  not  interleaved  with 
a  withdrawal  or  a  session  reset.  This  definition  is  stricter 
than  the  one  in  [2]  where  an  update  is  considered  a  dupli¬ 
cate  (AADup)  if  its  AS-Path  and  Next-Hop  do  not  change. 
When  we  count  duplicates,  we  include  the  initial  duplicated 
route  advertisement. 

We  also  define  the  ratio  of  duplicates  as  the  number  of 
duplicates  (including  the  original  messages)  over  the  total 
number  of  messages.  With  this  dehnition,  a  trace  where 
every  advertisement  is  duplicated  will  have  a  ratio  of  100%. 

2.2  Real  BGP  feed  experiment 

The  objective  of  this  experiment  is  to  manually  investigate 
some  occurrences  of  duplicates  by  correlating  the  duplicates 
observed  at  the  output  of  a  router  with  the  messages  it  re¬ 
ceives.  Our  setup  is  shown  in  Fig.  1.  Devices  rO,  rl  (Cisco) 
and  r2  (Juniper)  are  real  routers  while  monO  is  a  dedicated 
host  running  a  software  BGP  router  (Quagga). 

ASreal  AS65002  AS65004 


Figure  1:  Setup  for  the  I/O  correlation. 

The  router  under  test  is  r2.  It  receives  BGP  messages 
from  rO  and  rl  through  input  eBGP  sessions.  After  selecting 
its  best  routes,  r2  sends  BGP  messages  over  a  single  output 
eBGP  session  to  monO.  The  routes  learned  by  rO  and  rl 
are  from  real  BGP  feeds  received  in  September  2013  for  a 
duration  of  23  days. 

The  monO  host  captures  all  the  BGP  messages  received 
on  the  mirror  and  output  sessions.  The  mirror  sessions 
(dashed  lines  on  Fig.  1)  allow  to  capture  the  input  routes 
advertised  by  the  upstream  routers  rO  and  rl.  To  reduce 
timing  differences  between  the  input  and  mirror  sessions, 
both  sessions  are  placed  in  the  same  update  group  on  rO  and 
rl.  The  Minimum  Route  Advertisement  Interval  (MRAI)  is 
also  set  to  zero  on  these  routers. 

The  messages  are  stored  in  MRT  format.  MRT  records 
route  advertisements,  route  changes  and  route  withdrawals. 
Each  record  contains  a  timestamp  and  the  path  attributes. 


TCP-level  traces  of  all  the  BGP  messages  received  are  also 
captured.  This  allows  us  to  validate  the  MRT  capture  and 
dwelve  deeper  in  the  BGP  message  packet  details  e.g.  to 
check  the  ordering  of  attributes. 

We  describe  in  the  following  paragraphs  two  common  cases 
we  observed.  The  hrst  case  involves  the  Multi-Exit-Discri- 
minator  (MED)  attribute  while  the  second  case  involves  a 
rewritten  Next-Hop.  We  do  not  know  the  exact  frequency 
of  these  cases,  as  we  have  to  manually  extract  the  data. 
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Figure  2:  Gommon  causes  of  duplicates.  Timeline  of  the 
updates  seen  at  the  output  of  each  router. 

In  the  MED  case,  illustrated  in  Fig.  2a,  we  believe  the 
duplicate  is  caused  by  a  MED  attribute  stripped  at  the  out¬ 
put  of  r2.  Three  different  input  routes  are  involved,  all  for 
the  same  IPv4  prefix.  The  hrst  route.  A,  has  an  AS-Path  of 
length  5  and  a  MED  value  of  0.  The  second  route,  B,  has 
the  same  AS  Path  as  A  but  a  MED  value  of  2.  The  third 
route,  C,  has  an  AS  Path  of  length  6  and  a  MED  value 
of  0.  At  time  0ms,  r2  announces  route  A  learned  from  rO. 
Before  announcing  A,  r2  updates  the  AS-Path  and  strips 
the  MED,  which  produces  route  A' .  At  time  10ms,  rl  an¬ 
nounces  route  B  to  r2.  The  decision  process  of  r2  ranks 
route  A  better  than  route  B,  causing  no  change  in  r2’s  best 
route.  At  time  492ms,  rO  announces  to  r2  route  C  which 
has  a  longer  AS-Path.  Route  C  implicitly  withdraws  route 
A.  As  a  consequence,  r2  now  selects  route  B  as  best.  Be¬ 
fore  announcing  B,  r2  strips  the  MED  value,  producing  B' . 
Output  routes  A!  and  B'  are  equal,  hence  B'  is  a  duplicate 
of  A'. 

In  the  case  illustrated  in  Fig.  2b,  we  believe  the  duplicate 
is  caused  by  the  next-hop  attribute.  This  case  involves  two 
routes.  Route  A  announced  hrst  by  router  rl,  is  selected 
as  best  by  r2  and  announced  on  the  output  session  at  time 
0ms.  Before  announcing  route  A,  r2  rewrites  the  next-hop 
and  emits  route  A' .  At  time  801ms,  router  rl  explicitly 
withdraws  route  A.  At  time  802ms,  router  rO  announces 
route  B  although  it  does  not  trigger  any  change  in  r2  yet. 
Finally,  at  time  803ms,  router  r2  selects  route  B  as  best. 
Before  announcing  route  B,  r2  rewrites  the  next-hop  value 
with  its  own  IP  address,  leading  to  route  B' .  Routes  A  and 
B  only  differ  by  their  next-hop  (resp.  rl  and  rO),  hence 
routes  A'  and  B'  are  identical. 
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2.3  Controlled  experiment 

To  confirm  the  hypotheses  of  the  previous  section,  we  per¬ 
form  the  same  input/output  matching  in  a  fully  controlled 
experiment.  We  systematically  test  a  large  set  of  situations 
that  may  not  have  appeared  in  the  setting  with  a  real,  live 
BGP  feed.  We  are  able  to  find  additional  causes  of  dupli¬ 
cates  and  pinpoint  more  precisely  the  reasons  behind  these 
duplicates. 

The  setup  depicted  in  Fig.  3  is  similar  to  the  previous 
experiment  except  we  use  a  machine  injO,  running  Linux, 
to  inject  crafted  updates  to  the  router  under  test,  rO,  and 
another  to  capture  its  output.  Router  rO  is  a  Cisco  7200 
running  lOS  vl5.3.  On  injQ,  we  use  ExaBGP  [10]  to  inject 
synthetic  updates.  The  monitoring  host  monO  collects  the 
routes  observed  on  the  output  and  mirror  sessions  with  a 
Quagga  BGP  daemon  and  with  tcpdump.  The  mirror  ses¬ 
sion  is  used  to  validate  injO’s  program.  We  check  the  ability 
of  this  program  to  send  BGP  messages  accurately.  We  mea¬ 
sure  that  the  minimum  interval  between  two  consecutive 
updates  sent  by  ExaBGP  is  1ms. 


ExaBGP 


mirror  injO-rO 


MRT  +  tcpdump 


Figure  3:  Setup  for  the  injection. 

Table  1  summarizes  the  results  of  the  injection  experi¬ 
ment.  Due  to  space  limitations,  only  results  for  a  small 
number  of  test  cases  are  presented.  For  each  experiment, 
the  first  column  shows  the  average  delay  between  messages 
observed  on  the  input  and  its  standard  deviation.  Second 
column  shows  the  same  information  for  the  output.  The  last 
column  shows  the  ratio  of  duplicates.  That  is,  the  number 
of  duplicates  including  the  initial  update  over  the  number 
of  updates  (see  Section  2.1). 


Test  case 

Input  (ms) 

Output 

(ms) 

Dup. 

NotVisible 

- 

- 

100% 

RFlap  (1  ms) 

1.23  ±0.50 

3.47  ± 

3.46 

69.0% 

RFlap  (2  ms) 

2.07  ±0.39 

2.84  ± 

0.99 

25.9% 

RFlap  (3  ms) 

3.07  ±0.44 

3.06  ± 

0.48 

0.1% 

AFlap  (1  ms) 

1.22  ±0.69 

3.74  ± : 

17.25 

95.1% 

AFlap  (2  ms) 

2.07  ±0.36 

2.07  ± 

0.10 

4.7% 

AFlap  (3  ms) 

3.07  ±0.44 

3.06  ± 

0.09 

0.1% 

Table  1:  Results  of  selected  injection  test  cases. 

2.3. 1  Internal  /  non-transitive /filtered  attributes 
This  first  set  of  experiments  (NotVisible)  considers  the 
case  of  attributes  whose  changes  should  not  be  visible  from 
the  outside  of  an  AS  as  they  are  either  internal,  non-transitive 
or  filtered/rewritten  by  output  policies.  The  objective  of 
these  experiments  is  to  test  whether  or  not  such  attributes 
could  cause  duplicate  routes  to  be  sent  by  the  router. 

For  this  purpose,  we  repeatedly  send  a  sequence  of  2  route 
updates  {A,  B)  for  the  same  destination  prefix.  Route  B  dif¬ 
fers  from  route  A  for  only  a  specihc  internal  /  non-transitive 
/  hltered  attribute.  The  expected  behavior  is  as  follows. 
When  route  A  is  received,  it  is  selected  as  best  as  there  is 


no  other  choice.  It  is  then  propagated  on  the  output  ses¬ 
sion.  When  route  B  is  received,  it  replaces  route  A  (implicit 
withdraw).  Route  B  should  not  be  propagated  to  the  out¬ 
put  session  as  it  differs  from  route  A  only  by  an  attribute 
that  is  either  internal,  non-transitive,  or  removed  by  a  filter. 
Hence,  on  the  output  session,  routes  A  and  B  are  identical. 

We  observe  a  duplicate  ratio  of  100%  for  experiments  in 
this  class,  as  shown  in  Table  1  for  the  NotVisible  test  case. 
The  router  was  not  able  to  detect  that  the  second  route  was 
a  duplicate  of  the  previous.  We  explain  this  behavior  on  the 
statelessness  of  the  BGP  implementation. 

These  results  held  for  the  following  attributes:  MED,  Lo¬ 
cal  Pref,  Cluster  List,  and  Originator  ID.  We  also  observed  a 
100%  duplicates  ratio  for  non-transitive  Community  values, 
for  Community  values  stripped  by  outgoing  policies  and  for 
rewritten  Next- Hop  (as  already  observed  in  Section  2.2). 

2.3.2  Fast  flapping  route 

In  a  second  set  of  experiments  (RFlap)  we  investigate  the 
impact  of  a  flapping  route  on  the  generation  of  duplicates. 
The  experiment  relies  on  the  repetition  of  a  simple  sequence 
of  2  BGP  updates  (A,  W)  for  the  same  prefix.  A  announces 
a  route  while  W  withdraws  it. 

The  objective  of  this  experiment  is  to  trigger  duplicates 
by  forcing  a  route  to  change  multiple  times  before  the  router 
has  the  opportunity  to  propagate  it.  To  understand  this  be¬ 
havior,  we  need  to  refine  our  model  of  how  a  router  generates 
updates.  When  a  route  towards  a  prefix  changes,  the  main 
BGP  process  does  not  send  an  update  immediately.  Instead, 
this  task  is  delegated  to  a  separate  thread  that  periodically 
reads  the  RIB  and  advertises  the  routes  marked  as  changed. 

The  following  scenario  illustrates  how  the  transmission  of 
a  duplicate  update  can  be  caused.  When  the  first  Announce 
is  received,  the  route  is  marked  as  changed  in  the  RIB.  The 
RIB  is  then  scanned  and  an  update  is  sent.  Then,  the  With¬ 
draw  is  received  and  the  route  is  again  marked  as  changed. 
However,  before  the  RIB  is  scanned,  the  third  message  (sec¬ 
ond  Announce)  is  received  and  the  route  is  again  marked  as 
changed.  When  the  RIB  is  scanned,  the  second  Announce, 
identical  to  the  first  one  is  sent.  It  is  a  duplicate  as  the 
router  did  not  have  time  to  send  a  Withdraw  between  the 
two  Announces. 

We  repeat  this  experiment  with  increasing  delay  between 
updates:  1ms,  2ms  and  3ms.  The  results  are  in  Table  1 
for  test  case  RFlap.  We  observe  that  with  a  1ms  interval, 
almost  70%  of  output  updates  are  duplicates.  When  the 
interval  between  input  updates  increases,  the  ratio  of  du¬ 
plicates  decreases.  With  a  2ms  interval,  the  ratio  is  almost 
26%  and  at  3ms,  there  are  almost  no  duplicates. 

We  also  tested  the  impact  of  the  MRAI  on  the  generation 
of  duplicates.  We  conducted  the  same  experiment  with  a 
larger  interval  of  2  seconds  and  a  MRAI  set  to  6  seconds. 
With  this  experiment  we  still  generated  more  than  30%  of 
duplicates. 

2.3.3  Flapping  attribute 

This  third  set  of  experiments  (AFlap)  looks  at  flapping  at¬ 
tributes.  The  principle  is  identical  to  the  RFlap  experiment 
except  that  the  second  message  is  not  a  withdraw  but  an 
update  with  a  transitive  attribute  that  flaps  from  one  value 
to  another  and  back.  As  an  example,  we  present  the  results 
for  routes  where  the  origin  AS  in  the  AS-Path  has  value  x  in 
the  first  and  third  updates  and  has  value  y  x  in  the  sec- 
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ond  update.  We  see  in  Table  1  for  the  AFlap  test  cases  that 
the  ratio  of  duplicates  decreases  with  an  increasing  interval 
between  the  input  BGP  messages. 

The  explanation  for  these  results  is  analogous  to  the  RFlap 
experiment.  When  the  interval  between  messages  is  small, 
the  router  marks  the  route  as  changed  after  the  second  mes¬ 
sage,  but  the  third  message,  reversing  the  second  update, 
is  received  before  the  second  message  is  propagated  down¬ 
stream. 


3.  MITIGATING  DUPLICATES 

In  Section  2,  we  found  several  causes  explaining  the  gen¬ 
eration  of  duplicates.  According  to  the  BGP  specification, 
such  duplicates  should  not  appear.  When  a  router  adver¬ 
tises  a  route  for  a  given  prefix,  it  should  store  this  route  in 
the  RIB-Out  associated  with  the  peer.  When  it  later  ad¬ 
vertises  a  route  for  the  same  prefix,  it  looks  at  the  current 
entry  in  the  RIB-Out.  If  the  current  entry  is  the  same  as 
the  new  advertisement,  the  router  does  not  send  it  because 
it  would  be  a  duplicate  update. 

We  found  out  that  although  most  router  implementations 
support  a  RIB-Out,  the  implementation  might  be  partial  or 
operators  might  disable  it  to  spare  memory,  especially  on 
older  hardware.  Some  vendors  [11]  explicitly  recommend  to 
disable  the  RIB-Out  when  the  router  has  a  large  number  of 
peers. 

For  this  reason,  we  need  to  devise  a  solution  that  is  not  a 
full  RIB-out  but  that  still  significantly  reduces  the  number  of 
BGP  duplicates.  This  new  mechanism  must  come  at  a  lower 
cost  than  a  RIB-Out  in  terms  of  memory  consumption. 

To  obtain  a  baseline  on  the  possible  load  reduction,  we 
count  the  legitimate  updates  after  filtering  all  duplicates. 
We  compare  this  count  to  the  number  of  updates  in  the  orig¬ 
inal  trace.  We  use  a  BGP  trace  obtained  from  the  Equinix 
RouteViews  collector  and  focus  on  the  session  with  peer 
AS5769  (EQUIX-1).  Fig.  4  shows  two  12  hours  excerpts 
of  this  session  starting  on  2013-9-17  at  0:00  (left)  and  2013- 
9-18  at  4:00  (right).  The  Figure  shows  the  total  amount 
of  updates  received  during  the  last  hour  (dark  gray)  and 
the  same  information  after  all  duplicates  have  been  filtered 
(light  gray).  On  the  left  the  trace  has  a  relatively  low  rate 
of  duplicates.  We  observe  an  average  of  5,188  duplicates  per 
hour.  By  filtering  all  duplicates,  the  number  of  updates  on 
this  period  is  reduced  by  an  average  factor  of  1.62.  On  the 
right  the  trace  features  two  large  spikes  of  updates.  On  the 
largest  spike,  we  count  5.46*  10®  duplicates.  By  filtering  all 
duplicates,  the  number  of  updates  in  this  spike  is  reduced 
by  a  factor  of  5.08. 

We  observe  that  a  significant  reduction  in  BGP  traffic  can 
be  achieved  by  filtering  duplicate  updates.  If  CPU  usage  is 
proportional  to  the  number  of  updates,  sizable  improvement 
in  performance  can  be  expected  by  getting  rid  of  duplicates 
especially  on  small  routers  with  limited  CPU. 

3.1  Caching  router 

Instead  of  a  RIB-Out,  we  propose  a  small  cache  at  the  out¬ 
put  of  the  router  which  can  significantly  reduce  the  number 
of  duplicates  at  a  far  less  memory  cost.  The  advantage  of 
this  solution  is  that  it  can  easily  be  added  to  the  output  of  a 
router  with  little  modifications  of  the  BGP  implementation. 

A  cache  at  the  output  of  the  router  works  similarly  to  a 
RIB-Out  but  using  less  memory.  When  a  cache  reaches  its 
maximum  capacity,  it  must  remove  one  of  its  entries  to  add 
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Figure  4:  Two  excerpts  of  the  EQUIX-1  trace.  Low  rate 
of  duplicates  on  the  left.  Spikes  of  duplicates  on  the  right. 
We  compare  the  original  trace  to  the  same  trace  with  all 
duplicates  filtered. 


Name 

Eviction  strategy 

Iru  /  mru 
Irh  /  mrh 
Ifu  /  mfu 
Ifh  /  mfh 
random 

Least/most  recently  queried  entry. 
Least/most  recently  hit  entry. 
Least/most  frequently  queried  entry. 
Least/most  frequently  hit  entry. 
Random  entry. 

Table  2:  Eviction  strategies 


a  new  prefix.  There  are  multiple  ways  to  choose  which  prefix 
to  remove  when  the  cache  is  full.  These  selection  methods 
are  called  eviction  strategies.  A  cache  is  defined  by  its  size 
and  its  eviction  strategy. 

In  our  case,  the  cache  can  be  viewed  as  an  Abstract  Data 
Type  (ADT)  with  the  following  operations:  query,  remove 
and  clear.  The  query  operation  tells  if  an  entry  for  a  given 
key  and  value  exists.  If  the  given  value  is  different  from  the 
entry  in  the  cache,  the  entry  is  updated.  If  the  cache  does 
not  contain  an  entry  for  this  key,  it  adds  this  new  entry 
to  the  cache.  When  the  size  reaches  the  cache  limit,  the 
cache  eviction  strategy  comes  into  play.  An  entry  is  removed 
before  the  addition  of  the  new  entry  to  the  cache.  These 
two  cases  are  considered  miss  queries.  Instead,  if  the  cache 
contains  an  entry  for  this  key  with  the  same  value,  the  query 
is  considered  a  hit. 

The  remove  operation  takes  a  key  and  if  it  exists,  removes 
the  associated  entry  from  the  cache.  The  clear  operation 
removes  all  entries  from  the  cache. 

When  the  router  advertises  a  given  prefix  and  set  of  at¬ 
tributes,  it  queries  the  cache  with  the  prefix  as  the  key  and 
the  set  of  attributes  as  the  value.  In  the  case  of  a  hit,  the 
advertisement  is  a  duplicate  caught  by  the  cache,  and  the 
router  inhibits  the  advertisement.  In  the  case  of  a  miss,  an 
advertisement  is  sent  to  the  peer.  When  the  router  with¬ 
draws  a  given  prefix,  it  removes  the  cache  entry  with  the 
prefix  as  key  and  sends  the  withdraw  to  the  peer.  Finally 
when  the  router  opens  or  reopens  a  session,  the  cache  con¬ 
tent  is  cleared  and  the  router  sends  an  open  message  to  the 
peer. 

3.2  Evaluation  methodology 

We  assess  the  performance  of  the  cache  with  the  differ¬ 
ent  eviction  strategies  listed  in  Table  2.  The  random  cache 
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uses  a  pseudo  random  number  generator  to  select  an  entry 
to  remove.  We  use  this  strategy  as  a  baseline  to  determine 
if  other  strategies  are  able  to  exploit  characteristics  of  the 
input  trace  or  if  there  is  no  specihc  pattern  to  exploit.  Any 
such  strategy  should  perform  better  in  average  than  the  ran¬ 
dom  strategy. 

In  order  to  test  the  performance  of  the  cache,  we  replay 
through  the  cache  a  previously  captured  trace.  The  cache 
then  filters  the  duplicates.  Since  time  does  not  matter  for 
the  eviction  strategy,  the  cache  can  replay  the  trace  without 
taking  into  account  the  elapsed  time  between  each  message. 
As  a  result  it  is  possible  to  simulate  the  behavior  of  the 
cache  on  a  captured  trace  much  more  rapidly  than  playing 
it  directly  on  a  router. 

We  use  the  Minimum  Collection  Time  [12]  (MCT)  algo¬ 
rithm  to  accurately  identify  the  start  and  duration  of  the 
routing  table  transfers  in  the  BGP  trace.  We  add  an  im¬ 
plicit  OPEN  message  at  the  beginning  of  each  detected  ta¬ 
ble  transfer  so  that  updates  within  the  table  transfer  do  not 
count  as  duplicates. 

3.3  Dataset 

We  measured  the  updates  rate  and  duplicates  ratio  of  sev¬ 
eral  sessions  at  the  RouteViews  collectors  from  2009  to  2014. 
We  observed  that  the  duplicate  ratio  was  higher  than  10% 
on  48.5%  of  the  traces.  The  quantity  of  updates  and  dupli¬ 
cates  also  varies  greatly  from  one  session  to  another.  The 
average  rate  of  updates  and  duplicates  per  week  across  all 
traces  observed  in  2014  is  of  (3.6  ±  10.8)  millions  updates 
and  (1.0  ±  3.7)  millions  duplicates  respectively. 

In  order  to  take  this  variability  into  account,  we  apply  the 
cache  on  three  different  sessions  obtained  from  RouteViews 
collectors  during  one  week  period.  We  choose  these  three 
sessions  as  they  contain  a  significant  number  of  updates  (>  1 
million/ week)  but  exhibit  3  extreme  behaviours  for  what 
concerns  the  duplicates.  Fig.  5  shows  the  hourly  number  of 
duplicates  over  time  for  these  three  traces. 
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Figure  5:  Three  traces  with  different  duplicates  ratio.  Each 
point  shows  the  number  of  duplicates  seen  during  the  last 
hour. 


Cache 

WIDE 

32k  65k 

EQUIX-1 

32k  65k 

No  cache 

2.172% 

59.38% 

Ifh 

1.351% 

0.885% 

49.14% 

45.50% 

Ifu 

1.324% 

0.818% 

49.09% 

45.45% 

Irh 

0.040% 

0.009% 

42.91% 

42.27% 

Iru 

0.039% 

0.016% 

42.90% 

42.25% 

mfh 

1.556% 

1.121% 

53.85% 

50.30% 

mfu 

0.830% 

0.173% 

52.97% 

48.17% 

mrh 

1.555% 

1.078% 

53.34% 

49.68% 

mfu 

1.518% 

1.014% 

52.93% 

49.04% 

random 

0.042% 

0.020% 

42.98% 

41.87% 

Table  4:  Percentage  of  duplicates  at  the  output  of  the 
EQUIX-1  and  WIDE  traces  for  different  cache  eviction 
strategies  and  sizes  expressed  in  number  of  different  routes. 


EQUIX-1 

EQUIX-2 

WIDE 

Peer  ASN 
Start 

End 

Updates 

Duplicates 

Spikes 

5769 

2013-09-15 
2013-09-22 
4.5*  10® 
59.38% 
Large 

2914 

2014-10-15 
2014-10-22 
1.55*  10'^ 
98.36% 

No 

7500 

2013-09-15 
2013-09-22 
1.2*  10® 
2.17% 
Small 

Table  3:  Characteristics  of  three  different  traces. 


Table  3  summarizes  the  characteristics  of  the  traces.  The 
number  of  updates  and  the  ratio  of  duplicates  observed  vary 
greatly  from  one  trace  to  another.  The  hrst  trace,  EQUIX-1, 
exhibits  a  large  number  of  updates  (4.5*10®)  and  a  high  ratio 
of  duplicates  (59.38%),  a  large  fraction  of  which  (41%)  visi¬ 
ble  as  two  large  spikes  of  duplicates.  In  comparison  EQUIX- 
2  has  a  higher  number  of  updates  (1.55  *  10^)  and  a  higher 
ratio  of  duplicates  (98.36%)  but  displays  no  major  spike. 
Finally  the  WIDE  trace  has  a  very  low  ratio  of  duplicates 
(1.2  *  10®)  and  does  not  contain  any  large  spike. 

3.4  Results 

We  apply  the  cache  on  the  WIDE  and  EQUIX-1  traces 
presented  in  Section  3.3.  We  also  apply  the  cache  on  the 
third  trace,  EQUIX-2  with  a  fixed  size  of  65k  entries  and 


the  Iru  strategy.  These  traces  were  captured  at  different 
locations  and  time.  They  show  different  behaviours  against 
which  we  test  our  solution. 

Table  4  summarizes  the  percentage  of  duplicates  found 
at  the  output  of  the  WIDE  and  EQUIX-1  traces  for  two 
cache  sizes,  32768  (32k)  and  65536  (65k)  different  routes, 
and  multiple  strategies.  The  hrst  line  gives  the  duplicate 
ratio  of  the  original  trace  (no  cache  applied).  For  the  WIDE 
trace,  the  Iru  and  Irh  eviction  strategies  provide  the  best 
results.  The  best  cache,  Irh,  reduces  the  original  duplicate 
ratio  by  a  factor  241.  Eurther,  the  larger  cache  provides 
better  results.  In  the  case  of  the  WIDE  trace,  the  Iru  cache 
is  2.44  times  as  effective  in  hltering  the  duplicates  with  a 
cache  that  is  twice  as  large. 

On  the  EQUIX-1  trace,  the  cache  performs  poorly.  With 
a  32k  cache,  the  best  results  are  achieved  with  the  Iru  strat¬ 
egy.  However,  the  output  duplicate  ratio  remains  high,  at 
42.9%.  Doubling  the  cache  size  does  not  provide  as  much 
benefit  as  with  the  WIDE  trace.  Moreover,  a  striking  result 
is  that  in  the  case  of  the  large  cache,  the  random  eviction 
performs  better  than  the  other  techniques.  This  indicates 
that  the  eviction  strategies  are  not  able  to  properly  exploit 
the  characteristics  of  the  trace. 

These  results  suggest  that  a  higher  duplicate  ratio  inhibits 
the  performance  of  the  cache.  However,  when  we  apply  the 
Iru  cache  of  65k  on  the  EQUIX-2  trace,  which  exhibits  a 
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higher  duplicates  ratio  than  EQUIX-1,  the  duplicate  ratio 
drops  from  98.36%  to  5.83%.  This  reduces  the  number  of 
updates  for  the  trace  by  a  factor  of  50. 

This  shows  that  a  cache  is  able  to  filter  a  session  with 
a  very  high  number  of  duplicates.  I.e.,  the  performance 
does  not  depend  on  the  number  of  duplicates  but  rather  on 
other  characteristics  of  the  trace.  Actually,  it  depends  on  the 
number  of  distinct  prefixes  at  the  origin  of  those  duplicates. 
During  the  EQUIX-2  trace  this  number  stays  at  an  average 
of  1000  prefixes  per  hour.  During  the  EQUIX-1  trace  this 
number  stays  at  the  same  value  most  of  the  time.  However 
when  the  largest  spike  of  duplicates  occurs  more  than  2  *  10® 
distinct  prefixes  are  involved  during  less  than  one  hour.  As 
a  result  the  cache  did  not  retain  most  of  the  route  changes 
occurring  during  this  period.  Hence  subsequent  duplicates 
caused  by  these  routes  were  not  filtered  by  the  cache. 

3.5  Discussion 

Although  a  cache  is  effective  in  filtering  feeds  with  a  high 
ratio  of  duplicates  (e.g.  EQUIX-2),  we  observed  that  spikes 
of  updates  involving  a  large  number  of  distinct  prefixes  are 
detrimental  to  the  performance  of  the  cache.  These  spikes 
can  have  multiple  origins.  First,  spikes  of  updates  can  be 
caused  by  large  routing  events  beyond  the  router.  Second, 
spikes  can  be  caused  by  routing  table  transfers  following  a 
session  reset  or  a  change  in  outbound  policies.  It  is  indeed 
common  for  network  operators  to  prompt  a  table  trans¬ 
fer  with  a  ROUTE  REFRESH  message  in  order  to  apply 
changes  in  their  inbound  policies.  However  spikes  in  this 
second  category  must  have  been  filtered  by  the  MCT  algo¬ 
rithm  applied  beforehand. 

While  we  can  explain  the  origin  of  spikes,  we  do  not  know 
if  these  spikes  represent  a  frequent  feature  of  the  BGP  ses¬ 
sions.  We  now  measure  the  maximum  spike  size  in  term 
of  distinct  prefixes  for  all  RouteViews  sessions  we  observed 
during  the  year  2014.  We  also  apply  a  Iru  cache  of  65k 
entries  on  all  these  traces  to  map  the  performance  of  the 
cache  to  the  size  of  the  spikes  observed  in  the  sessions.  The 
sample  size  for  all  measured  sessions  is  of  1339  traces. 

We  define  attenuation  as  the  ratio  of  the  number  of  dupli¬ 
cates  seen  in  the  original  trace  over  the  number  of  duplicates 
seen  after  the  cache.  The  average  attenuation  of  duplicates 
for  all  observed  traces  is  300.47.  If  we  distinguish  the  traces 
by  the  size  of  their  maximum  spikes,  the  average  attenua¬ 
tion  for  traces  with  spikes  larger  and  smaller  than  the  size 
of  the  cache  are  1.26  and  370.06  respectively. 

The  existence  of  updates  spikes  can  negatively  impact  the 
possibility  to  mitigate  the  duplicates.  We  measured  the 
presence  of  spikes  among  all  observed  sessions  in  2014.  For 
this  purpose,  we  consider  there  is  a  spike  in  a  trace  when 
more  than  65k  distinct  prefixes  at  the  origin  of  future  du¬ 
plicates  are  transferred  in  less  than  one  hour.  According  to 
this  definition,  11.73%  of  the  traces  displayed  large  spikes  of 
duplicates. 

4.  CONCLUSION 

Redundant  consecutive  BGP  announcements  consume  un¬ 
necessary  bandwidth  and  CPU  in  routers.  In  addition,  these 
messages  delay  the  propagation  of  useful  routing  informa¬ 
tion.  We  observed  that  BGP  sessions  exhibit  different  be¬ 
haviors.  For  some  session  the  number  of  duplicates  is  low. 
But  other  sessions  can  exhibit  a  very  high  ratio  of  dupli¬ 
cates.  We  identified  large  spikes  of  duplicates  in  11.73%  of 


the  sessions  we  observed  in  2014.  This  may  be  a  problem 
on  chatty  sessions. 

We  then  identified  three  causes  of  duplicates:  changes  in 
attributes  that  are  not  propagated  further,  flapping  of  routes 
or  attributes  and,  finally,  incorrect  implementations  for  sets 
in  AS-Paths.  We  verified  these  causes  by  performing  thor¬ 
ough  controlled  experiments. 

To  mitigate  the  problem  we  propose  use  of  a  cache  to  find 
the  right  trade-off  between  additional  memory  consumption 
and  the  reduction  of  duplicates.  We  show  that  the  perfor¬ 
mance  of  a  cache  highly  depends  on  the  characteristics  of 
the  BGP  trace,  in  addition  to  the  eviction  strategy.  While 
a  cache  is  suitable  on  some  traces,  it  is  not  always  the 
case.  The  current  trend  of  pushing  control  functions  out¬ 
side  the  router,  to  devices  that  are  not  as  limited  memory- 
wise,  opens  the  door  to  full  Adj-RIB-Outs  and  thus  enable 
to  avoid  using  pretty  hacks  to  get  rid  of  BGP  duplicates 
completely  in  the  future. 
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Report  on  International  Submarine  Cables  Landing 
in  the  US 
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US  Landing  Points  for  International  Submarine 
Cables 


Landing  1 


Bandon.  Oregon,  United  States 


Location:  (124.4°W,  43.12°N) 
1  International  Cable: 

•  FASTER 


Owners: 

Google,  KDDI,  SingTel,  China  Telecom,  China  Mobile,  Global  Transit 
Other  Countries: 

Japan,  Taiwan 


Landing  2 


Bellport  New  York,  United  States 


Location:  (72.94°W,  40.76°N) 
1  International  Cable: 

•  Yellow 


Owners: 

Level  3 

Other  Country: 

United  Kingdom 
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Boca  Raton,  FL,  United  States 


Location:  (80.09°W,  26.35°N) 

6  International  Cables: 

•  South  Ameriea-1  tSAm-11 

Owners: 

Telxius 

Other  Countries: 

Argentina,  Brazil,  Chile,  Colombia,  Dominiean  Republie,  Eeuador,  Guatemala,  Peru 

•  Bahamas  Internet  Cable  System  tBICSl 

Owners: 

Caribbean  Crossings 
Other  Country: 

Bahamas 

•  Monet 
Owners: 

Angola  Cables,  Google,  Algar  Telecom,  Antel  Uruguay 
Other  Country: 

Brazil 

•  Deep  Blue  Cable 
Owners: 

Deep  Blue  Cable 
Other  Countries: 

Anguilla,  Aruba,  Bonaire,  Sint  Eustatius,  and  Saba,  Cayman  Islands,  Colombia,  Cura9ao, 
Dominiean  Republie,  Haiti,  Jamaiea,  Panama,  Saint  Martin,  Trinidad  and  Tobago,  Turks  and 
Caieos  Islands 

•  GlobeNet 

Owners: 

BTG  Pactual 
Other  Countries: 

Bermuda,  Brazil,  Colombia,  Venezuela 

•  Colombia-Florida  Subsea  Tiber  (CFX-1) 

Owners: 

C&W  Networks 
Other  Countries: 

Colombia,  Jamaiea 


Landing  3 
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Brookhaven,  New  York,  United  States 


Location:  (72.9 1°W,  40.77°N) 

1  International  Cable: 

•  Atlantie  Crossing- 1  tAC-11 

Owners: 

Level  3 

Other  Countries: 

Germany,  Netherlands,  United  Kingdom 


Buffalo,  New  York.  United  States 


Loeation:  (78.88°W,  42.89°N) 

1  International  Cable: 

•  Crosslake  Fibre 

Owners: 

Crosslake  Fibre 
Other  Country: 

Canada 


Charlestown,  Rhode  Island,  United  States 


Loeation:  (7L65°W,  4L41°N) 

1  International  Cable: 

•  Challenger  Bermuda- 1  (CB-11 

Owners: 

Cable  Co. 

Other  Country: 

Bermuda 


Landing  6 


Landing  5 


Landing  4 
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El  Segundo,  California,  United  States 

Location:  (118.4°W,  33.92°N) 

1  International  Cable: 

•  Paeifie  Light  Cable  Network  tPLCNl 

Owners: 

Paeifie  Light  Data  Communieation  Co.  Ltd.,  Google,  Facebook 
Other  Countries: 

China,  Philippines,  Taiwan 


Grover  Beach.  California.  United  States 


Loeation:  (120.6°W,  35.12°N) 

2  International  Cables: 

•  Pan-Ameriean  Crossing  tPACl 

Owners: 

Level  3 

Other  Countries: 

Costa  Riea,  Mexieo,  Panama 

•  Paeifie  Crossing- 1  iPC-ll 

Owners: 

NTT 

Other  Country: 

Japan 
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Landing  9 


Harbour  Pointe,  Washington,  United  States 


Location:  (122.3°W,  47.89°N) 

1  International  Cable: 

•  Paeifie  Crossing- 1  iPC-ll 

Owners: 

NTT 

Other  Country: 

Japan 


Hermosa  Beach,  California.  United  States 


Loeation:  (118.4°W,  33.86°N) 

2  International  Cables: 

•  JUPITER 
Owners: 

Amazon,  Faeebook,  NTT,  PLOT,  PCCW,  Softbank  Teleeom 
Other  Countries: 

Japan,  Philippines 

•  SEA-US 
Owners: 

RTI,  Inc.,  Globe  Teleeom,  Hawaiian  Telcom,  GTA  TeleGuam,  Telin,  Balau  Submarine  Cable 
Company,  Federated  States  of  Micronesia  Telecommunieations  Company 
Other  Countries: 

Federated  States  of  Mieronesia,  Indonesia,  Palau,  Philippines 
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Landing  11 


Hillsboro,  Oregon,  United  States 


Location:  (123°W,  45.52°N) 

2  International  Cables: 

•  Southern  Cross  Cable  Network  tSCCNl 

Owners: 

Spark  New  Zealand,  SingTel  Optus,  Verizon 
Other  Countries: 

Australia,  Fiji,  New  Zealand 

•  Tata  TGN-Pacifie 


Owners: 

Tata  Communieations 
Other  Country: 

Japan 
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Landing  12 


Hollywood,  Florida,  United  States 


Location:  (80.16°W,  26.0 1°N) 
4  International  Cables: 

•  Columbus-III 


Owners: 

Teleeom  Italia  Sparkle,  AT&T,  Verizon,  Telefoniea,  Portugal  Teleeom,  Tata  Communications, 
Ukrtelecom,  Telkom  South  Africa,  Telecom  Argentina,  Institute  Costarrieense  de  Eleetricidad, 
Embratel,  Cyta 
Other  Countries: 

Italy,  Portugal,  Spain 

•  America  Movil  Submarine  Cable  System- 1  (AMX-II 

Owners: 

Ameriea  M6vil 
Other  Countries: 

Brazil,  Colombia,  Dominican  Republic,  Guatemala,  Mexico 

•  Americas-II 


Owners: 

Embratel,  AT&T,  Verizon,  Sprint,  CANTV,  Tata  Communieations,  Eevel  3,  Teleeom  Argentina, 
Orange,  Portugal  Teleeom,  C&W  Networks,  Telecom  Italia  Sparkle,  Entel  Chile 
Other  Countries: 

Brazil,  Curasao,  Ereneh  Guiana,  Martinique,  Trinidad  and  Tobago,  Venezuela 
•  Mava-1 
Owners: 

Verizon,  AT&T,  Sprint,  Hondutel,  Telefoniea,  Orbitel,  Teleeom  Italia  Sparkle,  C&W  Networks, 
Entel  Chile,  Embratel,  ETB,  Axtel,  Institute  Costarrieense  de  Eleetrieidad,  Proximus,  Prepa 
Networks,  Orange,  Trieom,  RSL  Teleeom,  Ameriea  M6vil 
Other  Countries: 

Cayman  Islands,  Colombia,  Costa  Riea,  Honduras,  Mexico,  Panama 
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Island  Park,  New  York,  United  States 

Location:  (73.66°W,  40.6°N) 

1  International  Cable: 

•  FLAG  Atlantie  - 1  tFA- 1 1 

Owners: 

Global  Cloud  Xehange 
Other  Countries: 

Franee,  United  Kingdom 


Isla  Verde.  Puerto  Rico.  United  States 


Loeation:  (66.02°W,  18.44°N) 

3  International  Cables: 

•  Saint  Maarten  Puerto  Rieo  Network  One  (SMPR-11 

Owners: 

TelEm  Group,  Dauphin  Teleeom 
Other  Countries: 

Saint  Martin,  Sint  Maarten 

•  ARCOS 
Owners: 

C&W  Networks,  CANTV,  Codetel,  Hondutel,  Belize  Telemedia,  Enitel,  AT&T,  Alestra, 
Verizon,  RACSA,  United  Telecommunication  Services  (UTS),  Teleearrier,  Tricorn  USA, 
Telecomunicaciones  Ultramarinas  de  Puerto  Rieo,  Intemexa,  Orbinet  Overseas,  Telepuerto  San 
Isidro,  Bahamas  Telecommunieations  Company,  Instituto  Costarrieense  de  Eleetrieidad,  Orbitel 
Other  Countries: 

Bahamas,  Belize,  Colombia,  Costa  Rica,  Cura9ao,  Dominican  Republic,  Guatemala,  Honduras, 
Mexieo,  Niearagua,  Panama,  Turks  and  Caicos  Islands,  Venezuela 

•  Antillas  1 
Owners: 

AT&T,  Verizon,  Sprint,  Tata  Communieations,  Orange,  C&W  Networks,  Telecom  Italia 
Sparkle,  Embratel 
Other  Country: 

Dominiean  Republie 
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Jacksonville,  Florida,  United 


Location:  (81.66°W,  30.33°N) 

3  International  Cables: 

•  Ameriea  Movil  Submarine  Cable  System- 1  tAMX-11 

Owners: 

Ameriea  Movil 
Other  Countries: 

Brazil,  Colombia,  Dominiean  Republie,  Guatemala,  Mexieo 

•  South  Ameriea  Pacific  Link  tSAPLl 

Owners: 

Oeean  Networks 
Other  Countries: 

Chile,  Panama 

•  Pacifie  Caribbean  Cable  System  (PCCSl 

Owners: 

C&W  Networks,  Teleonet,  Setar,  United  Teleeommunieation  Serviees  (UTS),  Telxius 
Other  Countries: 

Aruba,  Colombia,  Cura9ao,  Eeuador,  Panama 


Kahe  Point,  Hawaii,  United  States 


Loeation:  (158. 1°W,  2L35°N) 

1  International  Cable: 

•  Southern  Cross  Cable  Network  tSCCN) 

Owners: 

Spark  New  Zealand,  SingTel  Optus,  Verizon 
Other  Countries: 

Australia,  Fiji,  New  Zealand 


Landing  16 


States 


Landing  15 
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Kapolet  HL  United  States 

Location:  (158. 1°W,  21.34°N) 

1  International  Cable: 

•  Hawaiki 
Owners: 

Hawaiki  Cable  Company 
Other  Countries: 

Australia,  New  Zealand 


Kawaihae,  Hawaii.  United  States 


Loeation:  (155. 8°W,  20.04°N) 

1  International  Cable: 

•  Honotua 
Owners: 

OPT  Freneh  Polynesia 
Other  Country: 

Freneh  Polynesia 
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Keawaula,  Hawaii,  United  States 

Location:  (158.2°W,  21.43°N) 

2  International  Cables: 

•  Telstra  Endeavour 

Owners: 

Telstra 

Other  Country: 

Australia 

•  Asia-Ameriea  Gateway  tAAGl  Cable  System 

Owners: 

Telekom  Malaysia,  AT&T,  Starhub,  PLDT,  Communieations  Authority  of  Thailand,  Airtel 
(Bharti),  Telstra,  Telkom  Indonesia,  BT,  Eastern  Telecom,  PT  Indonesia  Satellite  Corp.,  Spark 
New  Zealand,  Viettel  Corporation,  Saigon  Postel  Corporation,  Vietnam  Telecom  International, 
Brunei  International  Gateway,  BayanTel,  Ezeeom 
Other  Countries: 

Brunei,  China,  Malaysia,  Philippines,  Singapore,  Thailand,  Vietnam 


Landing  20 


Los  Angeles.  California.  United  States 


Eoeation:  (118.2°W,  34.05°N) 

1  International  Cable: 

•  Tata  TGN-Paeifie 
Owners: 

Tata  Communieations 
Other  Country: 

Japan 
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Landing  21 


Lynn,  Massachusetts,  United  States 


Location:  (70.95°W,  42.46°N) 

1  International  Cable: 

•  GTT  Atlantie 

Owners: 

GTT 

Other  Countries: 

Canada,  Ireland,  United  Kingdom 


Makaha.  Hawaii.  United  States 


Loeation:  (158.2°W,  21.46°N) 

3  International  Cables: 

•  Japan-U.S.  Cable  Network  (JUS) 

Owners: 

Verizon,  AT&T,  BT,  Sprint,  CenturyLink,  KDDI,  NTT,  Chunghwa  Teleeom,  Tata 
Communieations,  SingTel,  Telekom  Malaysia,  Softbank  Teleeom,  Orange,  Level  3,  SK 
Broadband,  KT,  China  Teleeom,  China  Unieom,  LG  Uplus,  HKBN  Enterprise  Solutions, 
Starhub,  PCCW,  Telstra,  Vodafone,  PLDT 
Other  Country: 

Japan 

•  South  Ameriea  Pacific  Link  (SAPLl 

Owners: 

Oeean  Networks 
Other  Countries: 

Chile,  Panama 

•  SEA-US 
Owners: 

RTI,  Inc.,  Globe  Teleeom,  Hawaiian  Telcom,  GTA  TeleGuam,  Telin,  Balau  Submarine  Cable 
Company,  Eederated  States  of  Micronesia  Teleeommunieations  Company 
Other  Countries: 

Eederated  States  of  Mieronesia,  Indonesia,  Palau,  Philippines 
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Manasquan,  New  Jersey,  United  States 


Location:  (74.05°W,  40.12°N) 

3  International  Cables: 

•  TAT- 14 
Owners: 

BT,  Verizon,  Deutsehe  Telekom,  Orange,  Sprint,  TeliaSonera,  Level  3,  KPN,  Telenor,  Etisalat, 
OTEGLOBE,  SingTel,  KDDI,  Softbank  Teleeom,  Zayo  Group,  Portugal  Teleeom,  Slovak 
Telekom,  TDC,  Telus,  Tata  Communieations,  Telefoniea,  AT&T,  Proximus,  Elisa  Corporation, 
Cyta,  Rosteleeom,  Vodafone 
Other  Countries: 

Denmark,  Erance,  Germany,  Netherlands,  United  Kingdom 

•  Gemini  Bermuda 

Owners: 

C&W  Networks 
Other  Country: 

Bermuda 

•  Apollo 

Owners: 

Vodafone 
Other  Countries: 

Eranee,  United  Kingdom 


Manchesten  California,  United  States 


Eoeation:  (123.7°W,  38.97°N) 

1  International  Cable: 

•  Japan-U.S.  Cable  Network  tJUSl 

Owners: 

Verizon,  AT&T,  BT,  Sprint,  CenturyLink,  KDDI,  NTT,  Chunghwa  Telecom,  Tata 
Communications,  SingTel,  Telekom  Malaysia,  Softbank  Teleeom,  Orange,  Level  3,  SK 
Broadband,  KT,  China  Teleeom,  China  Unieom,  LG  Uplus,  HKBN  Enterprise  Solutions, 
Starhub,  PCCW,  Telstra,  Vodafone,  PEDT 
Other  Country: 

Japan 


Landing  24 


Landing  23 
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Miraman  Puerto  Rico,  United  States 


Location:  (66.08°W,  18.45°N) 

2  International  Cables: 

•  Amerieas-II 
Owners: 

Embratel,  AT&T,  Verizon,  Sprint,  CANTV,  Tata  Communications,  Level  3,  Telecom  Argentina, 
Orange,  Portugal  Teleeom,  C&W  Networks,  Telecom  Italia  Sparkle,  Entel  Chile 
Other  Countries: 

Brazil,  Curasao,  French  Guiana,  Martinique,  Trinidad  and  Tobago,  Venezuela 

•  Antillas  1 
Owners: 

AT&T,  Verizon,  Sprint,  Tata  Communieations,  Orange,  C&W  Networks,  Telecom  Italia 
Sparkle,  Embratel 
Other  Country: 

Dominican  Republic 


Morro  Bay.  California,  United  States 


Eocation:  (120.8°W,  35.37°N) 

2  International  Cables: 

•  Japan-U.S.  Cable  Network  (JUS) 

Owners: 

Verizon,  AT&T,  BT,  Sprint,  CenturyLink,  KDDI,  NTT,  Chunghwa  Teleeom,  Tata 
Communieations,  SingTel,  Telekom  Malaysia,  Softbank  Teleeom,  Orange,  Level  3,  SK 
Broadband,  KT,  China  Teleeom,  China  Unieom,  LG  Uplus,  HKBN  Enterprise  Solutions, 
Starhub,  PCCW,  Telstra,  Vodafone,  PEDT 
Other  Country: 

Japan 

•  Southern  Cross  Cable  Network  (SCCNl 

Owners: 

Spark  New  Zealand,  SingTel  Optus,  Verizon 
Other  Countries: 

Australia,  Fiji,  New  Zealand 


Landing  26 


Landing  25 
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Naples,  FL,  United  States 


Location:  (81.8°W,  26.14°N) 

1  International  Cable: 

•  Deep  Blue  Cable 
Owners: 

Deep  Blue  Cable 
Other  Countries: 

Anguilla,  Aruba,  Bonaire,  Sint  Eustatius,  and  Saba,  Cayman  Islands,  Colombia,  Cura9ao, 
Dominiean  Republie,  Haiti,  Jamaiea,  Panama,  Saint  Martin,  Trinidad  and  Tobago,  Turks  and 
Caieos  Islands 


Nedonna  Beach,  Oregon,  United  States 


Loeation:  (123.9°W,  45.64°N) 

1  International  Cable: 

•  Trans-Paeific  Express  (TPEl  Cable  System 

Owners: 

China  Teleeom,  China  Unieom,  Chunghwa  Teleeom,  KT,  Verizon,  NTT,  AT&T 
Other  Countries: 

China,  Japan,  Taiwan 
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North  Miami  Beach,  Florida,  United  States 


Location:  (80.16°W,  25.93°N) 

1  International  Cable: 

•  ARCOS 
Owners: 

C&W  Networks,  CANTV,  Codetel,  Hondutel,  Belize  Telemedia,  Enitel,  AT&T,  Alestra, 
Verizon,  RACSA,  United  Telecommunication  Services  (UTS),  Teleearrier,  Tricorn  USA, 
Telecomunicaciones  Ultramarinas  de  Puerto  Rieo,  Intemexa,  Orbinet  Overseas,  Telepuerto  San 
Isidro,  Bahamas  Telecommunieations  Company,  Instituto  Costarrieense  de  Eleetrieidad,  Orbitel 
Other  Countries: 

Bahamas,  Belize,  Colombia,  Costa  Rica,  Cura9ao,  Dominican  Republic,  Guatemala,  Honduras, 
Mexieo,  Niearagua,  Panama,  Turks  and  Caicos  Islands,  Venezuela 


Northport  New  York.  United  States 


Eoeation:  (73.34°W,  40.9 1°N) 

1  International  Cable: 

•  EE  AG  Atlantie  - 1  tPA- 1 1 

Owners: 

Global  Cloud  Xehange 
Other  Countries: 

Eranee,  United  Kingdom 


Landing  30 


Landing  29 
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Pacific  City,  OR,  United  States 


Location:  (124°W,  45.2°N) 

2  International  Cables: 

•  Hawaiki 
Owners: 

Hawaiki  Cable  Company 
Other  Countries: 

Australia,  New  Zealand 

•  New  Cross  Pacific  tNCPl  Cable  System 

Owners: 

China  Teleeom,  China  Unieom,  Chunghwa  Teleeom,  KT,  China  Mobile,  Mierosoft,  Softbank 
Teleeom 
Other  Countries: 

China,  Japan,  Taiwan 


Pago  Pago,  American  Samoa 


Loeation:  (170.7°W,  -14.28°N) 

2  International  Cables: 

•  Hawaiki 
Owners: 

Hawaiki  Cable  Company 
Other  Countries: 

Australia,  New  Zealand 

•  Samoa-Ameriean  Samoa  tSASl 

Owners: 

Ameriean  Samoa  Government,  Elandia 
Other  Country: 

Samoa 
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Landing  33 


Pitt  Guam 


Location:  (-144.7°W,  13.46°N) 

5  International  Cables: 

•  HANTRUl  Cable  System 


Owners: 

Hannon  Armstrong,  Federated  States  of  Micronesia  Telecommunieations  Company,  Marshall 
Islands  Teleeommunications  Authority 
Other  Country: 

Federated  States  of  Mieronesia 

•  PIPE  Pacific  Cable- 1  tPPC-ll 

Owners: 

TPG 

Other  Countries: 

Australia,  Papua  New  Guinea 

•  Hong  Kong-Guam  tHK-Gl 

Owners: 

RTI  Conneetivity 
Other  Country: 

China 

•  Tata  TGN-Paeifie 


Owners: 

Tata  Communieations 
Other  Country: 

Japan 

•  SEA-US 


Owners: 

RTI,  Inc.,  Globe  Teleeom,  Hawaiian  Teleom,  GTA  TeleGuam,  Telin,  Baku  Submarine  Cable 
Company,  Federated  States  of  Micronesia  Telecommunieations  Company 
Other  Countries: 

Federated  States  of  Micronesia,  Indonesia,  Palau,  Philippines 
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Landing  34 


Redondo  Beach,  California,  United  States 


Location:  (118.4°W,  33.84°N) 

1  International  Cable: 

•  Unity/EAC-Pacifie 
Owners: 

Telstra,  Google,  Global  Transit,  SingTel,  KDDI,  Airtel  (Bharti) 
Other  Country: 

Japan 
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Landing  35 


San  Juan,  Puerto  Rico,  United  States 


Location:  (66.11°W,  18.47°N) 

7  International  Cables: 

•  Ameriea  Movil  Submarine  Cable  System- 1  tAMX-11 

Owners: 

Ameriea  Movil 
Other  Countries: 

Brazil,  Colombia,  Dominiean  Republie,  Guatemala,  Mexieo 

•  South  Ameriea-1  tSAm-11 

Owners: 

Telxius 

Other  Countries: 

Argentina,  Brazil,  Chile,  Colombia,  Dominiean  Republie,  Eeuador,  Guatemala,  Peru 

•  Deep  Blue  Cable 
Owners: 

Deep  Blue  Cable 
Other  Countries: 

Anguilla,  Aruba,  Bonaire,  Sint  Eustatius,  and  Saba,  Cayman  Islands,  Colombia,  Curasao, 
Dominiean  Republie,  Haiti,  Jamaiea,  Panama,  Saint  Martin,  Trinidad  and  Tobago,  Turks  and 
Caieos  Islands 

•  Global  Caribbean  Network  tGCNl 

Owners: 

Leueadia  National  Corporation,  Loret  Group 
Other  Country: 

Guadeloupe 

•  Paeifie  Caribbean  Cable  System  tPCCSl 

Owners: 

C&W  Networks,  Telconet,  Setar,  United  Teleeommunication  Services  (UTS),  Telxius 
Other  Countries: 

Aruba,  Colombia,  Curasao,  Ecuador,  Panama 

•  Southern  Caribbean  Fiber 


Owners: 

Digieel 

Other  Countries: 

Antigua  and  Barbuda,  Barbados,  Dominiea,  Grenada,  Guadeloupe,  Martinique,  Saint- 
Barthelemy,  Saint  Kitts  and  Nevis,  Saint  Lueia,  Saint  Martin,  Saint  Vincent  and  the  Grenadines, 
Trinidad  and  Tobago 
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Owners; 

Telxius 

Other  Country: 
Brazil 


Landing  36 


San  Luis  Obispo.  California.  United  States 


Location:  (120.7°W,  35.29°N) 

1  International  Cable: 

•  Asia- America  Gateway  lAAG)  Cable  System 

Owners: 

Telekom  Malaysia,  AT&T,  Starhub,  PLDT,  Communications  Authority  of  Thailand,  Airtel 
(Bharti),  Telstra,  Telkom  Indonesia,  BT,  Eastern  Telecom,  PT  Indonesia  Satellite  Corp.,  Spark 
New  Zealand,  Viettel  Corporation,  Saigon  Postel  Corporation,  Vietnam  Telecom  International, 
Brunei  International  Gateway,  BayanTel,  Ezecom 
Other  Countries: 

Brunei,  China,  Malaysia,  Philippines,  Singapore,  Thailand,  Vietnam 


Landing  37 


Sarasota,  Florida,  United  States 


Eocation:  (82.54°W,  27.34°N) 
1  International  Cable; 

•  AURORA 


Owners: 

EP  Telecommunications 
Other  Countries: 

Belize,  Chile,  Colombia,  Costa  Rica,  Ecuador,  Guatemala,  Honduras,  Mexico,  Nicaragua, 
Panama 
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Shirley,  New  York,  United  States 


Location:  (72.87°W,  40.8°N) 

2  International  Cables: 

•  ARConneet  tAECl 

Owners: 

Aqua  Comms 
Other  Country: 

Ireland 

•  Apollo 

Owners: 

Vodafone 
Other  Countries: 

Franee,  United  Kingdom 


Spanish  River  Park,  Florida,  United  States 


Loeation:  (80.07°W,  26.38°N) 

1  International  Cable: 

•  Bahamas  Internet  Cable  System  tBICSl 

Owners: 

Caribbean  Crossings 
Other  Country: 

Bahamas 


Landing  39 


Landing  38 
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Landing  40 


Spencer  Beach,  Hawaii,  United  States 


Location:  (155. 8°W,  20.02°N) 

1  International  Cable: 

•  Southern  Cross  Cable  Network  tSCCNl 

Owners: 

Spark  New  Zealand,  SingTel  Optus,  Verizon 
Other  Countries: 

Australia,  Fiji,  New  Zealand 
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Landing  41 


St.  Croix,  Virgin  Islands,  United  States 


Location:  (64.82°W,  17.77°N) 

5  International  Cables: 

•  South  Ameriean  Crossing  tSACVLatin  Ameriean  Nautilus  tLANl 

Owners: 

Level  3,  Teleeom  Italia  Sparkle 
Other  Countries: 

Argentina,  Brazil,  Chile,  Colombia,  Panama,  Peru,  Venezuela 

•  Amerieas-II 


Owners: 

Embratel,  AT&T,  Verizon,  Sprint,  CANTV,  Tata  Communieations,  Level  3,  Teleeom  Argentina, 
Orange,  Portugal  Teleeom,  C&W  Networks,  Telecom  Italia  Sparkle,  Entel  Chile 
Other  Countries: 

Brazil,  Curasao,  Freneh  Guiana,  Martinique,  Trinidad  and  Tobago,  Venezuela 

•  Pan  Ameriean  tPAN-AM) 

Owners: 

AT&T,  Telefoniea  del  Peru,  Softbank  Teleeom,  Teleeom  Italia  Sparkle,  Sprint,  CANTV,  Tata 
Communieations,  Telefoniea  de  Argentina,  Telstra,  Verizon,  Entel  Chile,  Teleeom  Argentina, 
Teleonet,  Institute  Costarrieense  de  Eleetrieidad,  C&W  Networks,  Embratel 
Other  Countries: 

Aruba,  Chile,  Colombia,  Eeuador,  Panama,  Peru,  Venezuela 

•  Global  Caribbean  Network  (GCN) 

Owners: 

Eeueadia  National  Corporation,  Loret  Group 
Other  Country: 

Guadeloupe 

•  Southern  Caribbean  Fiber 


Owners: 

Digicel 

Other  Countries: 

Antigua  and  Barbuda,  Barbados,  Dominiea,  Grenada,  Guadeloupe,  Martinique,  Saint- 
Barthelemy,  Saint  Kitts  and  Nevis,  Saint  Eueia,  Saint  Martin,  Saint  Vineent  and  the  Grenadines, 
Trinidad  and  Tobago 
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Tanguisson  Point 


Location:  (-144.8°W,  13.55°N) 

2  International  Cables: 

•  Asia-Ameriea  Gateway  tAAGl  Cable  System 

Owners: 

Telekom  Malaysia,  AT&T,  Starhub,  PLDT,  Communieations  Authority  of  Thailand,  Airtel 
(Bharti),  Telstra,  Telkom  Indonesia,  BT,  Eastern  Telecom,  PT  Indonesia  Satellite  Corp.,  Spark 
New  Zealand,  Viettel  Corporation,  Saigon  Postel  Corporation,  Vietnam  Teleeom  International, 
Brunei  International  Gateway,  BayanTel,  Ezeeom 
Other  Countries: 

Brunei,  China,  Malaysia,  Philippines,  Singapore,  Thailand,  Vietnam 

•  Australia- Japan  Cable  tAJCI 

Owners: 

Softbank  Teleeom,  Telstra,  Verizon,  AT&T 
Other  Countries: 

Australia,  Japan 


Tuckerton.  New  Jersey.  United  States 


Loeation:  (74.34°W,  39.6°N) 

2  International  Cables: 

•  TAT- 14 
Owners: 

BT,  Verizon,  Deutsehe  Telekom,  Orange,  Sprint,  TeliaSonera,  Level  3,  KPN,  Telenor,  Etisalat, 
OTEGLOBE,  SingTel,  KDDI,  Softbank  Teleeom,  Zayo  Group,  Portugal  Teleeom,  Slovak 
Telekom,  TDC,  Telus,  Tata  Communieations,  Telefoniea,  AT&T,  Proximus,  Elisa  Corporation, 
Cyta,  Rosteleeom,  Vodafone 
Other  Countries: 

Denmark,  Erance,  Germany,  Netherlands,  United  Kingdom 

•  GlobeNet 

Owners: 

BTG  Paetual 
Other  Countries: 

Bermuda,  Brazil,  Colombia,  Venezuela 


Landing  43 


Guam 


Landing  42 
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Turnon  Bay,  Guam 


Location:  (-144.8°W,  13.5 1°N) 

2  International  Cables: 

•  Guam  Okinawa  Kyushu  Ineheon  tGOKD 

Owners: 

AT&T 

Other  Country: 

Japan 

•  Australia- Japan  Cable  tAJCl 

Owners: 

Softbank  Teleeom,  Telstra,  Verizon,  AT&T 
Other  Countries: 

Australia,  Japan 


Vero  Beach,  Florida,  United  States 


Loeation:  (80.39°W,  27.64°N) 

1  International  Cable: 

•  Bahamas  2 
Owners: 

AT&T,  Telefoniea,  Verizon 
Other  Country: 

Bahamas 


Landing  45 


Landing  44 
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Virginia  Beach,  Virginia,  United  States 

Location:  (76.06°W,  36.76°N) 

3  International  Cables: 

•  MAREA 
Owners: 

Faeebook,  Mierosoft,  Telxius 
Other  Country: 

Spain 

•  Midgardsormen 

Owners: 

Midgardsormen 
Other  Country: 

Denmark 

•  BRUSA 

Owners: 

Telxius 

Other  Country: 

Brazil 


Wall  Township.  New  Jersey.  United  States 


Loeation:  (74.06°W,  40.15°N) 

2  International  Cables: 

•  Tata  TGN-Atlantie 
Owners: 

Tata  Communieations 
Other  Country: 

United  Kingdom 

•  Seabras-1 

Owners: 

Seaborn  Group 
Other  Country: 

Brazil 
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International  Submarine  Cables  Landing  in  the  US 


AEConnect  (AEC) 


More  info: 

http://www.aquacomms.com 

Owners: 

Aqua  Comms 
Length: 

5,536  km 
US  Landing  Point: 

•  Shirley.  New  York,  United  States 

Other  Country: 

Ireland 


America  Movil  Submarine  Cable  Svstem-1  (AMX-1) 


More  info: 

http://www.americamovil.com 

Owners: 

America  M6vil 
Length: 

17,800  km 
US  Landing  Points: 

•  Hollywood.  Florida.  United  States 

•  Jacksonville.  Florida.  United  States 

•  San  Juan.  Puerto  Rico.  United  States 

Other  Countries: 

Brazil,  Colombia,  Dominican  Republic,  Guatemala,  Mexico 


Cable  2 


Cable  1 
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Americas-II 


Owners: 

Embratel,  AT&T,  Verizon,  Sprint,  CANTV,  Tata  Communieations,  Level  3,  Teleeom  Argentina, 
Orange,  Portugal  Telecom,  C&W  Networks,  Telecom  Italia  Sparkle,  Entel  Chile 
Length: 

8,373  km 

US  Landing  Points: 


•  Hollywood.  Llorida.  United  States 

•  Miramar.  Puerto  Rico.  United  States 

•  St.  Croix.  Virgin  Islands.  United  States 

Other  Countries: 

Brazil,  Curasao,  Lrench  Guiana,  Martinique,  Trinidad  and  Tobago,  Venezuela 


Antillas  1 


Owners: 

AT&T,  Verizon,  Sprint,  Tata  Communications,  Orange,  C&W  Networks,  Telecom  Italia  Sparkle, 
Embratel 
Length: 

650  km 

US  Landing  Points: 

•  Isla  Verde.  Puerto  Rico.  United  States 

•  Miramar.  Puerto  Rico.  United  States 


Other  Country: 

Dominican  Republic 


Case  1:15  cv  00662  TSE  Document  168  4  Filed  12/18/18  Pago  80  of  1208 

Apollo 


More  info: 

http://www.vodafone.coin/business/article-cs-apollo-submarine-cable-svstem 

Owners: 

Vodafone 

Length: 

13,000  km 
US  Landing  Points: 

•  Manasquan,  New  Jersey.  United  States 

•  Shirley.  New  York.  United  States 

Other  Countries: 

France,  United  Kingdom 


ARCOS 


More  info: 

http://www.cwnetworks.com/ 

Owners: 

C&W  Networks,  CANTV,  Codetel,  Hondutel,  Belize  Telemedia,  Enitel,  AT&T,  Alestra,  Verizon, 
RACSA,  United  Telecommunication  Services  (UTS),  Telecarrier,  Tricorn  USA,  Telecomunicaciones 
Ultramarinas  de  Puerto  Rico,  Internexa,  Orbinet  Overseas,  Telepuerto  San  Isidro,  Bahamas 
Telecommunications  Company,  Instituto  Costarricense  de  Electricidad,  Orbitel 
Length: 

8,600  km 

US  Landing  Points: 

•  North  Miami  Beach.  Florida.  United  States 

•  Isla  Verde.  Puerto  Rico.  United  States 

Other  Countries: 

Bahamas,  Belize,  Colombia,  Costa  Rica,  Curasao,  Dominican  Republic,  Guatemala,  Honduras, 
Mexico,  Nicaragua,  Panama,  Turks  and  Caicos  Islands,  Venezuela 


Cable  6 


Cable  5 
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Asia- America  Gateway  (AAG)  Cable  System 


More  info: 

http://www.asia-america-gatewav.com 

Owners: 

Telekom  Malaysia,  AT&T,  Starhub,  PLOT,  Communications  Authority  of  Thailand,  Airtel  (Bharti), 
Telstra,  Telkom  Indonesia,  BT,  Eastern  Telecom,  PT  Indonesia  Satellite  Corp.,  Spark  New  Zealand, 
Viettel  Corporation,  Saigon  Postel  Corporation,  Vietnam  Telecom  International,  Brunei  International 
Gateway,  BayanTel,  Ezecom 
Eength: 

20,000  km 
US  Eanding  Points: 

•  Keawaula,  Hawaii.  United  States 

•  San  Luis  Obispo.  California,  United  States 

•  Tanguisson  Point.  Guam 

Other  Countries: 

Brunei,  China,  Malaysia,  Philippines,  Singapore,  Thailand,  Vietnam 


Atlantic  Crossing-1  (AC- 


More  info: 

http://www.level3.com 

Owners: 

Level  3 
Length: 

14,301  km 
US  Landing  Point: 

•  Brookhaven.  New  York.  United  States 
Other  Countries: 

Germany,  Netherlands,  United  Kingdom 


Cable  8 


Cable  7 
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AURORA 


More  info: 

http://fptelecoms.com/ 

Owners: 

FP  Telecommunications 
Length: 

n.a. 

US  Landing  Point: 

•  Sarasota.  Florida.  United  States 
Other  Countries: 

Belize,  Chile,  Colombia,  Costa  Rica,  Ecuador,  Guatemala,  Honduras,  Mexico,  Nicaragua,  Panama 


Australia-Japan  Cable  (AJC) 


More  info: 

http://www.aicable.com 

Owners: 

Softbank  Telecom,  Telstra,  Verizon,  AT&T 
Length: 

12,700  km 
US  Landing  Points: 


Tanguisson  Point.  Guam 

Turnon  Bay.  Guam 


Other  Countries: 

Australia,  Japan 
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Bahamas  2 


Owners: 

AT&T,  Telefonica,  Verizon 
Length: 

470  km 

US  Landing  Point: 


Vero  Beach.  Florida.  United  States 


Other  Country: 
Bahamas 


Bahamas  Internet  Cable  System  (BICS) 


More  info: 

http://www.caribbeancrossmgs.com 

Owners: 

Caribbean  Crossings 
Length: 

1,100  km 

US  Landing  Points: 

•  Boca  Raton.  FL.  United  States 

•  Spanish  River  Park.  Florida.  United  States 

Other  Country: 

Bahamas 
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BRUSA 


More  info: 

http://www.telxius.com 

Owners: 

Telxius 

Length: 

11,000  km 
US  Landing  Points: 

•  San  Juan.  Puerto  Rico.  United  States 

•  Virginia  Beach.  Virginia.  United  States 

Other  Country: 

Brazil 


Challenger  Bermuda-1  (CB-1) 


More  info: 

http://cableco.bm 

Owners: 

Cable  Co. 

Length: 

1,448  km 

US  Landing  Point: 

•  Charlestown.  Rhode  Island.  United  States 

Other  Country: 

Bermuda 


Cable  14 


Cable  13 
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Colombia-Florida  Subsea  Fiber  (CFX-1) 


More  info: 

http://www.cwnetworks.coin/ 

Owners: 

C&W  Networks 
Length: 

2,400  km 
US  Landing  Point: 

•  Boca  Raton.  FL,  United  States 

Other  Countries: 

Colombia,  Jamaica 


Columbus-III 


Owners: 

Telecom  Italia  Sparkle,  AT&T,  Verizon,  Telefonica,  Portugal  Telecom,  Tata  Communications, 
Ukrtelecom,  Telkom  South  Africa,  Telecom  Argentina,  Institute  Costarricense  de  Electricidad, 
Embratel,  Cyta 
Eength: 

9,833  km 
US  Eanding  Point: 

•  Hollywood.  Elorida.  United  States 

Other  Countries: 

Italy,  Portugal,  Spain 


Cable  16 


Cable  15 
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Crosslake  Fibre 


More  info: 

http://www.crosslakefibre.ca 

Owners: 

Crosslake  Fibre 
Length: 

131  km 

US  Landing  Point: 

•  Buffalo.  New  York.  United  States 

Other  Country: 

Canada 


Deep  Blue  Cable 


More  info: 

http://www.deepbluecable.com 

Owners: 

Deep  Blue  Cable 
Length: 

12,000  km 
US  Landing  Points: 

•  Boca  Raton.  FL.  United  States 

•  San  Juan.  Puerto  Rico.  United  States 

•  Naples.  FL.  United  States 

Other  Countries: 

Anguilla,  Aruba,  Bonaire,  Sint  Eustatius,  and  Saba,  Cayman  Islands,  Colombia,  Cura9ao,  Dominican 
Republic,  Haiti,  Jamaica,  Panama,  Saint  Martin,  Trinidad  and  Tobago,  Turks  and  Caicos  Islands 


Cable  18 


Cable  17 
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FASTER 


Owners: 

Google,  KDDI,  SingTel,  China  Telecom,  China  Mobile,  Global  Transit 
Length: 

11,629  km 
US  Landing  Point: 

•  Bandon.  Oregon.  United  States 

Other  Countries: 

Japan,  Taiwan 


FLAG  Atlantic-1  (FA-1) 


More  info: 

http://www.globalcloudxchange.com 

Owners: 

Global  Cloud  Xchange 
Length: 

14,500  km 
US  Landing  Points: 

•  Island  Park.  New  York.  United  States 

•  Northport.  New  York.  United  States 

Other  Countries: 

France,  United  Kingdom 
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Gemini  Bermuda 


More  info: 

http://www.cwnetworks.com 

Owners: 

C&W  Networks 
Length: 

1,287  km 

US  Landing  Point: 

•  Manasquan,  New  Jersey.  United  States 

Other  Country: 

Bermuda 


Global  Caribbean  Network  (GCN) 


More  info: 

http://www.globalcaribbean.net 

Owners: 

Leucadia  National  Corporation,  Loret  Group 
Length: 
n.a. 

US  Landing  Points: 

•  San  Juan.  Puerto  Rico.  United  States 

•  St.  Croix.  Virgin  Islands.  United  States 

Other  Country: 

Guadeloupe 


Cable  22 


Cable  21 
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More  info: 

http://www.globenet.net 

Owners: 

BTG  Paetual 
Length: 

23,500  km 
US  Landing  Points: 

•  Boea  Raton.  FL,  United  States 

•  Tuekerton.  New  Jersey.  United  States 

Other  Countries: 

Bermuda,  Brazil,  Colombia,  Venezuela 


GTT  Atlantic 


More  info: 

http://www.gtt.net 

Owners: 

GTT 

Length: 

12,200  km 
US  Landing  Point: 

•  T.ynn.  Massaehusetts.  United  States 
Other  Countries: 

Canada,  Ireland,  United  Kingdom 


Cable  24 


GlobeNet 


Cable  23 
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Guam  Okinawa  Kyushu  Incheon  (GOKD 


More  info: 

http://www.att.com 

Owners: 

AT&T 

Length: 

4,244  km 
US  Landing  Point: 

•  Turnon  Bay,  Guam 

Other  Country: 

Japan 


HANTRUl  Cable  System 


Owners: 

Hannon  Armstrong,  Federated  States  of  Micronesia  Telecommunications  Company,  Marshall  Islands 
Telecommunications  Authority 
Length: 

2,917  km 
US  Landing  Point: 

•  Piti.  Guam 

Other  Country: 

Federated  States  of  Micronesia 


Cable  26 


Cable  25 
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Hawaiki 


More  info: 

http://hawaikicable.co.nz 

Owners: 

Hawaiki  Cable  Company 
Length: 

14,000  km 
US  Landing  Points: 

•  Kapolei.  HI,  United  States 

•  Pacific  City.  OR.  United  States 

•  Pago  Pago,  American  Samoa 

Other  Countries: 

Australia,  New  Zealand 


Hong  Kong-Guam  (HK-G) 


Owners: 

RTI  Connectivity 
Length: 

3,900  km 
US  Landing  Point: 

•  Piti.  Guam 

Other  Country: 

China 
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Honotua 


More  info: 

http://www.opt.pf 

Owners: 

OPT  French  Polynesia 
Length: 

4,805  km 
US  Landing  Point: 

•  Kawaihae.  Hawaii.  United  States 

Other  Country: 

French  Polynesia 


Japan-U.S.  Cable  Network  (JUS) 


Owners: 

Verizon,  AT&T,  BT,  Sprint,  CenturyLink,  KDDI,  NTT,  Chunghwa  Telecom,  Tata  Communications, 
SingTel,  Telekom  Malaysia,  Softbank  Telecom,  Orange,  Level  3,  SK  Broadband,  KT,  China  Telecom, 
China  Unicom,  LG  Uplus,  HKBN  Enterprise  Solutions,  Starhub,  PCCW,  Telstra,  Vodafone,  PLDT 
Length: 

22,682  km 
US  Landing  Points: 

•  Makaha,  Hawaii.  United  States 

•  Manchester.  California.  United  States 

•  Morro  Bay.  California.  United  States 

Other  Country: 

Japan 
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JUPITER 


Owners: 

Amazon,  Facebook,  NTT,  PLDT,  PCCW,  Softbank  Telecom 
Length: 

14,000  km 
US  Landing  Point: 

•  Hermosa  Beach.  California.  United  States 

Other  Countries: 

Japan,  Philippines 


MAREA 


Owners: 

Facebook,  Microsoft,  Telxius 
Length: 

6,605  km 
US  Landing  Point: 


Virginia  Beach.  Virginia.  United  States 


Other  Country: 
Spain 


Mava-1 


More  info: 

http://www.maya-l  .com 
Owners: 

Verizon,  AT&T,  Sprint,  Hondutel,  Telefonica,  Orbitel,  Telecom  Italia  Sparkle,  C&W  Networks,  Entel 
Chile,  Embratel,  ETB,  Axtel,  Instituto  Costarricense  de  Electricidad,  Proximus,  Prepa  Networks, 
Orange,  Tricorn,  RSL  Telecom,  America  M6vil 
Length: 

4,400  km 
US  Landing  Point: 

•  Hollywood.  Elorida,  United  States 

Other  Countries: 

Cayman  Islands,  Colombia,  Costa  Rica,  Honduras,  Mexico,  Panama 


Case  1:15  cv  00662  TSE  Document  168  4  Filed  12/18/18  Pago  04  of  1208 

Midgardsormen 


More  info: 

http://midgardsormen.net 

Owners: 

Midgardsormen 

Length: 

7,848  km 
US  Landing  Point: 


Virginia  Beaeh,  Virginia.  United  States 


Other  Country: 
Denmark 


Monet 


Owners: 

Angola  Cables,  Google,  Algar  Teleeom,  Antel  Uruguay 
Length: 

10,556  km 
US  Landing  Point: 

•  Boea  Raton.  FL.  United  States 

Other  Country: 

Brazil 


New  Cross  Pacific  (NCP)  Cable  System 


Owners: 

China  Telecom,  China  Unicom,  Chunghwa  Telecom,  KT,  China  Mobile,  Microsoft,  Softbank  Telecom 
Length: 

13,618  km 
US  Landing  Point: 

•  Pacific  City.  OR.  United  States 

Other  Countries: 

China,  Japan,  Taiwan 


Case  1:15  cv  00662  TSE  Document  168  4  Filed  12/18/18  Pago  05  of  1208 

Pacific  Caribbean  Cable  System  (PCCS) 


Owners: 

C&W  Networks,  Teleonet,  Setar,  United  Telecommunieation  Serviees  (UTS),  Telxius 
Length: 

6,000  km 

US  Landing  Points: 

•  Jaeksonville.  Florida.  United  States 

•  San  Juan.  Puerto  Rieo.  United  States 

Other  Countries: 

Aruba,  Colombia,  Cura9ao,  Eeuador,  Panama 


Pacific  Crossing-1  (PC-1) 


More  info: 

http://www.pel  .eom 
Owners: 

NTT 

Length: 

20,900  km 
US  Landing  Points: 

•  Grover  Beaeh.  California.  United  States 

•  Harbour  Pointe.  Washington.  United  States 

Other  Country: 

Japan 


Cable  38 


Cable  37 
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Pacific  Light  Cable  Network  (PLCN) 


More  info: 

http://pldc.com.lik 

Owners: 

Pacific  Light  Data  Communication  Co.  Ltd.,  Google,  Facebook 
Length: 

12,871  km 
US  Landing  Point: 

•  El  Segundo.  California.  United  States 

Other  Countries: 

China,  Philippines,  Taiwan 


Pan-American  Crossing  (PAC) 


More  info: 

http://www.level3.com 

Owners: 

Level  3 
Length: 

10,000  km 
US  Landing  Point: 

•  Grover  Beach.  California.  United  States 

Other  Countries: 

Costa  Rica,  Mexico,  Panama 


Cable  40 


Cable  39 
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Pan  American  (PAN-AM) 


Owners: 

AT&T,  Telefonica  del  Peru,  Softbank  Telecom,  Telecom  Italia  Sparkle,  Sprint,  CANTV,  Tata 
Communications,  Telefonica  de  Argentina,  Telstra,  Verizon,  Entel  Chile,  Telecom  Argentina, 
Telconet,  Institute  Costarricense  de  Electricidad,  C&W  Networks,  Embratel 
Eength: 

7,050  km 
US  Eanding  Point: 

•  St.  Croix.  Virgin  Islands.  United  States 
Other  Countries: 

Aruba,  Chile,  Colombia,  Ecuador,  Panama,  Peru,  Venezuela 


PIPE  Pacific  Cable-1  (PPC-1) 


More  info: 

http://www.pipenetworks.com/ppc  1 
Owners: 

TPG 

Eength: 

6,900  km 
US  Eanding  Point: 

•  Piti.  Guam 

Other  Countries: 

Australia,  Papua  New  Guinea 


Saint  Maarten  Puerto  Rico  Network  One  (SMPR-1) 


Owners: 

TelEm  Group,  Dauphin  Telecom 
Length: 

375  km 

US  Landing  Point: 

•  Isla  Verde.  Puerto  Rico.  United  States 

Other  Countries: 

Saint  Martin,  Sint  Maarten 


Cable  43 


Cable  42 


Cable  41 
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Samoa- American  Samoa  (SAS) 


Owners: 

American  Samoa  Government,  Elandia 
Length: 

250  km 

US  Landing  Point: 

•  Pago  Pago.  American  Samoa 

Other  Country: 

Samoa 


Seabras-1 


More  info: 

http://www.seabornnetworks.com 

Owners: 

Seaborn  Group 
Length: 

10,800  km 
US  Landing  Point: 

•  Wall  Township.  New  Jersey,  United  States 

Other  Country: 

Brazil 


Cable  45 


Cable  44 
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SEA-US 


Owners: 

RTI,  Inc.,  Globe  Telecom,  Hawaiian  Telcom,  GTA  TeleGuam,  Telin,  Baku  Submarine  Cable 
Company,  Federated  States  of  Micronesia  Telecommunications  Company 
Length: 

14,500  km 
US  Landing  Points: 

•  Hermosa  Beach.  California.  United  States 

•  Makaha.  Hawaii.  United  States 

•  Piti.  Guam 

Other  Countries: 

Federated  States  of  Micronesia,  Indonesia,  Palau,  Philippines 


South  America-1  (SAm-1) 


More  info: 

http://www.telxius.com/ 

Owners: 

Telxius 

Length: 

25,000  km 
US  Landing  Points: 

•  Boca  Raton.  FL,  United  States 

•  San  Juan.  Puerto  Rico.  United  States 

Other  Countries: 

Argentina,  Brazil,  Chile,  Colombia,  Dominican  Republic,  Ecuador,  Guatemala,  Peru 


Cable  47 


Cable  46 
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South  American  Crossing  (SACVLatin  American 

Nautilus  (LAN) 


More  info: 

http://www.level3.com 

Owners: 

Level  3,  Telecom  Italia  Sparkle 
Length: 

20,000  km 
US  Landing  Point: 

•  St.  Croix.  Virgin  Islands.  United  States 
Other  Countries: 

Argentina,  Brazil,  Chile,  Colombia,  Panama,  Peru,  Venezuela 


South  America  Pacific  Link  (SAPL) 


More  info: 

http://www.oceannetworks.com 

Owners: 

Ocean  Networks 
Length: 

17,600  km 
US  Landing  Points: 

•  Jacksonville.  Florida.  United  States 

•  Makaha.  Hawaii.  United  States 


Other  Countries: 

Chile,  Panama 
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Southern  Caribbean  Fiber 


More  info: 

http://www.southern-caribbean.com 

Owners: 

Digicel 

Length: 

n.a. 

US  Landing  Points: 

•  San  Juan.  Puerto  Rico.  United  States 

•  St.  Croix.  Virgin  Islands.  United  States 

Other  Countries: 

Antigua  and  Barbuda,  Barbados,  Dominica,  Grenada,  Guadeloupe,  Martinique,  Saint-Barthelemy, 
Saint  Kitts  and  Nevis,  Saint  Lucia,  Saint  Martin,  Saint  Vincent  and  the  Grenadines,  Trinidad  and 
Tobago 


Southern  Cross  Cable  Network  (SCCN) 


More  info: 

http://www.southerncrosscables.com 

Owners: 

Spark  New  Zealand,  SingTel  Optus,  Verizon 
Length: 

30,500  km 
US  Landing  Points: 

•  Hillsboro.  Oregon.  United  States 

•  Kahe  Point.  Hawaii.  United  States 

•  Morro  Bay.  California.  United  States 

•  Spencer  Beach.  Hawaii.  United  States 

Other  Countries: 

Australia,  Fiji,  New  Zealand 


Cable  51 


Cable  50 
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TAT-14 


More  info: 

https://www.tat-14.com 

Owners: 

BT,  Verizon,  Deutsche  Telekom,  Orange,  Sprint,  TeliaSonera,  Level  3,  KPN,  Telenor,  Etisalat, 
OTEGLOBE,  SingTel,  KDDI,  Softbank  Telecom,  Zayo  Group,  Portugal  Telecom,  Slovak  Telekom, 
TDC,  Telus,  Tata  Communications,  Telefonica,  AT&T,  Proximus,  Elisa  Corporation,  Cyta, 
Rostelecom,  Vodafone 
Length: 

15,295  km 
US  Landing  Points: 

•  Manasquan.  New  Jersey.  United  States 

•  Tuckerton,  New  Jersey.  United  States 

Other  Countries: 

Denmark,  France,  Germany,  Netherlands,  United  Kingdom 


Tata  TGN- Atlantic 


More  info: 

http://www.tatacommunications.com 

Owners: 

Tata  Communications 
Length: 

13,000  km 
US  Landing  Point: 

•  Wall  Township.  New  Jersey.  United  States 

Other  Country: 

United  Kingdom 
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Tata  TGN-Pacific 


More  info: 

http://www.tatacommunications.com 

Owners: 

Tata  Communications 
Length: 

22,300  km 
US  Landing  Points: 

•  Hillsboro.  Oregon.  United  States 

•  Los  Angeles.  California.  United  States 

•  Piti.  Guam 

Other  Country: 

Japan 


Telstra  Endeavour 


More  info: 

https://www.telstraglobal.com 

Owners: 

Telstra 

Length: 

9,125  km 
US  Landing  Point: 

•  Keawaula.  Hawaii.  United  States 

Other  Country: 

Australia 
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Trans-Pacific  Express  (TPE)  Cable  System 


More  info: 

http://tpecable.org 

Owners: 

China  Telecom,  China  Unicom,  Chunghwa  Telecom,  KT,  Verizon,  NTT,  AT&T 
Length: 

17,000  km 
US  Landing  Point: 

•  Nedonna  Beach.  Oregon.  United  States 

Other  Countries: 

China,  Japan,  Taiwan 


Unitv/E  AC -Pacific 


Owners: 

Telstra,  Google,  Global  Transit,  SingTel,  KDDI,  Airtel  (Bharti) 
Length: 

9,620  km 
US  Landing  Point: 

•  Redondo  Beach.  California.  United  States 

Other  Country: 

Japan 


Yellow 


More  info: 

http://www.level3.com 

Owners: 

Level  3 
Length: 
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PROCEEDINGS 

Page  8 

2 

MR.  ABDO:  Good  morning,  Ms.  Richards. 

3 

My  name  is  Alex  Abdo,  and  I'm  here  with  the  Knight 

4 

Eirst  Amendment  Institute  and  Columbia  University, 

5 

representing  the  Plaintiff  in  this  case.  Wikimedia 

6 

Eoundation . 

7 

I  think  you  met  everyone  down  the 

8 

line,  but  I'm  joined  by  my  colleagues,  Patrick 

9 

Toomey  from  the  American  Civil  Liberties  Union; 

10 

Devon  Hanley  Cook  from  Cooley  LLP;  and  Ashley 

11 

Gorski,  also  from  the  American  Civil  Liberties 

12 

Union . 

13 

Would  you  just  start  out  by  stating 

14 

your  full  name  for  the  record  and  spelling  it  for 

15 

us? 

16 

MR.  PATTON:  Could  we  just  before  we 

17 

begin  introduce  the  other  attorneys  here  just  for 

18 

the  record? 

19 

MR.  ABDO:  Please,  yeah. 

20 

MR.  PATTON:  I'm  Rodney  Patton  with 

21 

the  Department  of  Justice  representing  the  NSA. 

22 

MR.  PADGETT:  Jason  Padgett,  the 

TransPerfect  Legal  Solutions 
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1  Office  of  General  Counsel  at  the  National  Security 

2  Agency. 

3  MR.  GILLIGAN:  James  Gilligan  with  the 

4  DOJ  representing  the  defendants. 

MS.  Mary  with  the 

6  Office  of  General  Counsel  at  the  National  Security 

7  Agency. 

8  MS.  And  Cathleen 

9  Office  of  General  Counsel,  National 

10  Security  Agency. 

11  MR.  ABDO:  Great,  1  think  we're  done 

12  with  appearances. 

13  Ms.  Richards,  would  you  just  state 

14  your  full  name  and  spell  it  for  the  record? 

15  THE  WITNESS:  Rebecca  Joan  Richards, 

16  R-E-B-E-C-C-A,  J.  Richards,  R-l-C-H-A-R-D-S . 

17  MR.  PATTON:  This  is  Rodney  Patton  on 

18  behalf  of  Defendants  in  the  case.  The  parties 

19  have  agreed  to  the  following  rules  governing  the 

20  taking  of  this  deposition. 

21  One,  counsel  for  the  government  may 

22  make  such  objections  as  he  deems  in  good  faith  to 
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1 

be  necessary  to  prevent  the  unauthorized 
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2 

disclosure  of  protected,  classified,  or  privileged 

3 

information . 

4 

Two,  counsel  for  the  government  may  at 

5 

any  time  direct  the  witness  not  to  answer  a 

6 

question  or  to  stop  responding  to  a  question  if  he 

7 

deems  it  in  good  faith  that  it  is  necessary  to 

8 

prevent  the  unauthorized  disclosure  of  protected. 

9 

classified,  or  privileged  information. 

10 

Number  three,  counsel  for  the 

11 

government  or  the  witness  may  stop  the  deposition 

12 

at  any  time  in  order  to  confer  privately  in  a 

13 

Secure  Compartmented  Information  Facility,  known 

14 

as  a  SCIF,  for  the  purpose  of  preventing  the 

15 

unauthorized  disclosure  of  protected,  classified. 

16 

or  privileged  information. 

17 

Four,  nothing  in  the  testimony  of  the 

18 

witness  will  constitute  or  be  construed  as  a 

19 

waiver  of  the  applicable  protections  or  privileges 

20 

subject  to  the  plaintiffs  --  or  subject  to  the  NSA 

21 

reviewing  the  transcript. 

22 

Five,  during  the  deposition,  the 
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transcript  may  be  displayed  only  on  the  court 
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2 

reporter's  laptop,  and  it  will  not  be  otherwise 

3 

transferred  to  or  displayed  on  anyone  else's 

4 

electronic  device  during  the  deposition. 

5 

Six,  after  the  deposition,  the 

6 

transcript  will  be  transferred  from  the  court 

7 

reporter's  laptop  to  counsel  for  the  NSA  by  a  CD 

8 

or  flash  drive. 

9 

Seven,  the  transcript  of  the 

10 

deposition  will  not  otherwise  be  copied,  except  as 

11 

appropriate  by  the  NSA,  or  transmitted  from  the 

12 

court  reporter's  laptop  until  counsel  for  the  NSA 

13 

provides  the  Agency's  approval  to  do  so. 

14 

Finally,  in  the  meantime,  the  NSA  will 

15 

conduct  a  review  of  the  transcript  for  protected. 

16 

privileged,  and  classified  information,  and  will 

17 

redact  any  such  information  prior  to  the  release 

18 

of  the  transcript  to  plaintiff's  counsel,  or 

19 

anyone  other  than  the  NSA  and  the  court  reporter. 

20 

That's  all  the  ground  rules. 

21 

Thank  you. 

22 

MR.  ABDO:  Ms.  Jaques,  have  you  sworn 
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1 

Ms.  Richards  in?  Would  you  mind  doing  so? 

2 

THE  REPORTER:  Raise  your  right  hand. 

3 

ma ' am. 

4 

(The  witness  was  administered  the  oath.) 

5 

Whereupon, 

6 

REBECCA  J.  RICHARDS, 

7 

was 

called  as  a  witness,  after  having  been 

8 

first  duly  sworn  by  the  Notary  Public, 

9 

was 

examined  and  testified  as  follows: 

10 

EXAMINATION  BY  COUNSEL  EOR  PLAINTIEE 

11 

BY  MR.  ABDO: 

12 

Q 

Ms.  Richards,  you  understand  that 

13 

you ' re  here 

today  to  give  deposition  testimony  in 

14 

the  lawsuit 

of  Wikimedia  Eoundation  versus  NSA, 

15 

right? 

16 

A 

Yes  . 

17 

Q 

And  you  understand  that  you're  under 

18 

oath? 

19 

A 

Yes  . 

20 

Q 

Have  you  been  deposed  before? 

21 

A 

No. 

22 

Q 

Okay.  So  you  heard  a  portion  of  the 
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procedures  described  by  your  counsel,  Mr.  Patton. 
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2 

I'll  go  over  some  other  procedures  for  how  the 

3 

deposition  will  take  place. 

4 

So  we'll  be  asking  you  questions.  Our 

5 

questions  and  your  answers  will  be  recorded  by 

6 

Ms.  Jaques.  For  that  reason,  it's  important  that 

7 

you  speak  up  and  give  your  answers  orally  so  that 

8 

Ms.  Jaques  can  record  them,  transcribe  them.  She 

9 

won't  be  able  to  record  a  nod  or  a  shake  of  the 

10 

head . 

11 

Now,  I  may  on  occasion  ask  you  a 

12 

question  that  isn't  clear,  or  that  for  some  other 

13 

reason  you  don't  understand.  If  you  don't 

14 

understand  one  of  my  questions,  let  me  know.  It's 

15 

my  job  to  ask  you  clear  questions.  So  if  you  say 

16 

you  don't  understand  one.  I'll  try  to  make  it 

17 

clearer.  Do  you  understand  that? 

18 

A  Yes,  I  do. 

19 

Q  Good.  Your  counsel  may  object  at 

20 

various  points.  If  he  does,  please  go  ahead  and 

21 

answer  the  question  that  has  been  objected  to 

22 

unless  your  counsel  specifically  instructs  you  not 
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1 

to  answer.  Do  you  understand  that? 
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2 

A  Yes,  I  do. 

3 

Q  We'll  be  taking  periodic  breaks  during 

4 

the  deposition,  but  if  you  need  to  take  a  break  at 

5 

any  other  point,  let  us  know.  We  will  accommodate 

6 

you.  And  I  think  you  see  that  there's  some  water 

7 

and  coffee  in  the  corner.  If  you  need  anything. 

8 

just  help  yourself  at  any  point  during  the 

9 

deposition . 

10 

If  at  any  point  you  realize  that  an 

11 

answer  you've  given  is  incomplete  or  inaccurate 

12 

and  you'd  like  to  supplement  it  or  correct  it  in 

13 

any  way,  let  me  know  right  away  and  we'll  take 

14 

care  of  it  right  then.  Does  that  sound  okay? 

15 

A  Yes . 

16 

Q  And  if  at  any  point  in  answering  our 

17 

questions  you  think  of  a  document  that  would  be 

18 

helpful  in  refreshing  your  recollection,  in 

19 

answering  the  question,  or  in  recalling  what  has 

20 

been  publicly  disclosed  and  what  hasn't  about 

21 

upstream  surveillance,  please  tell  us.  We  likely 

22 

have  many  of  those  documents  here  today  and  would 
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1 

be  happy  to  provide  you  them.  Is  that  okay? 
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2 

A  Yes,  it  is. 

3 

Q  Great.  So  your  counsel,  Mr.  Patton, 

4 

outlined  the  process  that  the  parties  have  agreed 

5 

to  for  addressing  objections  based  on  information 

6 

the  NSA  believes  to  be  subject  to  the  state 

7 

secrets  privilege  or  protected  from  disclosure 

8 

under  50  U.S.C.  §  3024(1)  (1)  and/or 

9 

50  U.S.C.  §  3605(a).  We  will  adhere  to  that 

10 

process . 

11 

I'm  going  to  use  the  term  "classified" 

12 

to  refer  to  information  the  NSA  believes  is 

13 

protected  by  any  of  those  legal  authorities.  Is 

14 

that  okay  with  you  -- 

15 

A  Yes . 

16 

Q  --  that  shorthand? 

17 

MR.  PATTON:  Can  we  just  state  for  the 

18 

record  that  not  all  of  the  information  that  will 

19 

be  protected  by  3605,  for  example,  is  necessarily 

20 

classified,  but  I  understand  your  shorthand. 

21 

BY  MR.  ABDO: 

22 

Q  Please  take  your  time  when  answering 
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1 

our  questions .  Our  goal  is  not  to  trick  you  into 

Page  16 

2 

disclosing  protected  information.  We  have  a 

3 

process  in  place  to  address  those  sorts  of  claims. 

4 

but  for  that  process  to  work,  we  need  to  make  a 

5 

clear  record  concerning  any  information  the  NSA 

6 

believes  is  classified. 

7 

There  are  at  least  three  scenarios 

8 

that  may  arise.  First,  if  you  can  answer  a 

9 

question  fully  without  disclosing  information  that 

10 

the  NSA  believes  to  be  classified,  you  must  do  so. 

11 

Second,  if  you  believe  that  a  response 

12 

to  a  question  would  disclose  information  the  NSA 

13 

considers  classified,  you  should  clearly  state 

14 

that  for  the  record. 

15 

And,  third,  if  you  believe  that  a 

16 

question  calls  for  a  response  that  is  classified 

17 

in  part  and  unclassified  in  part,  please  also 

18 

state  that  clearly  for  the  record.  You  must 

19 

answer  and  provide  the  unclassified  information 

20 

even  if  that  does  not  constitute  a  complete 

21 

response  because  there  is  also  unclassified 

22 

information . 
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1 

Do  you  understand  those  three 
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2 

scenarios? 

3 

A  Yes,  I  do. 

4 

Q  Now,  this  case  concerns  surveillance 

5 

that  has  taken  place  from  2015  to  the  present. 

6 

Unless  I  say  otherwise,  my  questions  will  apply  to 

7 

that  full  period. 

8 

If  your  answer  would  differ  based  on 

9 

what  specific  portion  of  that  period  we're  talking 

10 

about,  please  say  so,  and  please  explain  how  it 

11 

would  differ  for  the  relevant  time  frames. 

12 

We  will  do  our  best  to  make  clear  what 

13 

time  frame  we're  talking  about,  and  then  I'm  sure 

14 

your  counsel  will  make  sure  we're  making  clear 

15 

what  time  frame  we're  talking  about,  but  if  we 

16 

haven't  specified,  please  do  your  best  to  answer 

17 

with  respect  to  the  full  period. 

18 

Is  there  any  reason  you  can  think  of 

19 

why  you  would  not  be  able  to  answer  our  questions 

20 

fully  and  accurately  today? 

21 

A  No. 

22 

MR.  PATTON:  Other  than  that  the 
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1 

answers  may  be  classified. 
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2 

THE  WITNESS:  Yeah. 

3 

BY  MR.  ABDO: 

4 

Q  Sorry,  sorry.  I  mean  are  you  taking 

5 

any  medications  or  drugs  that  would  make  it 

6 

difficult  for  you  to  answer  truthfully  or 

7 

accurately? 

8 

A  No. 

9 

Q  There's  nothing  that  is  affecting  your 

10 

memory  today? 

11 

A  No. 

12 

Q  Okay.  You  stated  before  that  you  have 

13 

not  been  deposed  before;  is  that  correct? 

14 

A  That's  correct. 

15 

Q  Have  you  ever  given  testimony  in  a 

16 

case? 

17 

A  No,  I  have  not. 

18 

Q  Okay.  You  understand  that  you're 

19 

appearing  here  today  as  a  designated 

20 

representative  of  the  NSA,  right? 

21 

A  Yes . 

22 

TransPerfect  Legal  Solutions 
212-400-8845  -  Depo@TransPerfect.com 


OlgiaeaiI555XZ^jQO06B2FEEE  DBoPoreBtilSSStS  FffflddLQMafl^aS  PB§gdL29  of  4098 


1 

(Deposition  Exhibit  41  was 

Page  19 

2 

marked  for  identification.) 

3 

BY  MR.  ABDO: 

4 

Q  So  you  have  in  front  of  you  what's 

5 

been  marked  as  Exhibit  41.  Do  you  recognize  that 

6 

document  marked  as  41? 

7 

A  Yeah. 

8 

Q  What  is  it? 

9 

A  These  are  the  topics  for  examination. 

10 

Do  you  want  me  to  read  more  fully? 

11 

Q  No,  no,  no. 

12 

A  How  detailed  would  you  like  me  to  be? 

13 

Q  I'm  asking  whether  that's  the 

14 

deposition  notice  that  the  plaintiff  served  on  the 

15 

defendants  in  this  case. 

16 

A  Oh,  yes,  it  is.  Sorry. 

17 

Q  And  you're  appearing  here  today  as  a 

18 

designee  of  the  NSA  on  topics  2,  3,  4a,  4d  and  6 

19 

as  set  forth  in  Exhibit  41;  is  that  correct? 

20 

A  Yes,  that  is  correct. 

21 

Q  Are  you  prepared  to  testify  today 

22 

about  those  topics? 
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1 

A 

Yes,  I  am. 

2 

Q 

Can  you  tell  us  what  you  did  to 

3 

prepare? 

4 

A 

Reviewed  the  documents  submitted,  as 

5 

well  as  a 

number  of  different  documents  that  are 

6 

already  ir 

L  the  unclassified  realm,  ranging  from 

7 

previous  minimization  procedures,  the  NSA  Civil 

8 

Liberties 

and  Privacy  Office  Report,  the  Privacy 

9 

and  Civil 

Liberties  Oversight  Board's  report  on 

10 

702,  FISC 

opinions,  as  well  as  NSA's  submissions 

11 

at  different  points  to  the  FISC. 

12 

Q 

The  FISC  opinions  that  you  reviewed. 

13 

are  those 

all  ones  that  have  been  disclosed 

14 

publicly? 

15 

A 

Yes.  I  only  reviewed  the  unclassified 

16 

versions , 

so  the  redacted  versions  that  are 

17 

readily  available  on  ODNI ' s  website. 

18 

Q 

Did  you  also  review  any  classified 

19 

FISC  opinions  or  other  documents  in  preparing  for 

20 

today's  deposition? 

21 

A 

No.  We  met  with  a  subject  --  I  met 

22 

with  a  subject  matter  expert.  We  discussed  what 
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was  classified  and  what  was  not  classified,  but 
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2 

otherwise  I 

didn't  review  any  classified 

3 

documents . 

4 

Q 

So  to  the  extent  you  talked  about 

5 

classified 

information,  it  was  with  a  subject 

6 

matter  expert,  but  not  reviewing  any  documents? 

7 

A 

Yes,  that's  correct. 

8 

Q 

Had  you  previously,  unrelated  to  this 

9 

litigation. 

reviewed  classified  versions  of  any  of 

10 

the  documents  that  you  reviewed  in  unclassified 

11 

form? 

12 

A 

Yes  . 

13 

Q 

Are  you  generally  familiar  with  the 

14 

classified 

portions  of  those  documents? 

15 

A 

Yes,  I  am. 

16 

Q 

Did  you  meet  with  your  counsel  in 

17 

preparing? 

18 

A 

I  did . 

19 

Q 

You  mentioned  that  you  met  with  a 

20 

subject  matter  expert.  That's  an  NSA  employee? 

21 

A 

Yes,  it's  an  NSA  employee. 

22 

Q 

What  role  does  that  individual  have 
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within  the  NSA? 
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2 

A  An  expert  in  upstream. 

3 

Q  Is  that  the  only  subject  matter  expert 

4 

within  the  NSA  you  met  with? 

5 

A  Yes,  it  is. 

6 

Q  What's  the  general  nature  of  what  you 

7 

talked  about  with  that  individual  in  unclassified 

8 

form? 

9 

A  We  reviewed  what  was  in  the  classified 

10 

and  in  the  unclassified  to  make  sure  we  had  a  full 

11 

understanding  of  how  upstream  worked  and  we  were 

12 

clear  as  to  --  I  was  clear  as  to  exactly  where 

13 

those  lines,  in  terms  of  classification  versus 

14 

nonclassif led  information,  could  be  discussed. 

15 

Q  Okay.  Was  the  primary  purpose  of  that 

16 

meeting  to  discuss  that  line  between  classified 

17 

and  unclassified  information? 

18 

A  It  was  more  just  to  make  sure  that  my 

19 

memory  from  all  of  the  work  we  had  done  over  the 

20 

last  four  years  at  NSA  on  upstream  was  current  and 

21 

understanding,  and  that  I  wasn't  mixing  and 

22 

matching  different  activities. 
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1 

So  it  was  more  of  a  verification  that 

Page  23 

2 

I  knew  exactly  what  it  was,  and  this  is  what  was 

3 

classified  and  this  wasn't. 

4 

Q  Aside  from  preparing  for  this 

5 

deposition,  have  you  been  involved  in  this 

6 

litigation  otherwise? 

7 

A  No,  I  have  not. 

8 

Q  You've  not  reviewed  any  of  the 

9 

government  submissions  in  this  case? 

10 

MR.  PATTON:  Objection,  vague  as  to 

11 

time . 

12 

BY  MR.  ABDO: 

13 

Q  You  can  answer  the  question. 

14 

A  I  reviewed  all  of  the  materials  that 

15 

have  been  provided,  most  everything  in  the 

16 

binders.  So,  yes,  I've  read  all  of  that  material. 

17 

Q  Did  you  review  any  documents  before 

18 

they  were  filed  by  the  government  in  this  case? 

19 

Let  me  try  that  again. 

20 

Did  you  review  any  of  the  government 

21 

submissions  in  this  case  prior  to  their  being 

22 

filed  in  court? 
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1 

A 

I  did  not. 

Page  24 

2 

Q 

Have  you  been  involved  in  any  other 

3 

litigation 

concerning  Section  702  of  the  Foreign 

4 

Intelligence  Surveillance  Act? 

5 

A 

No,  I  have  not. 

6 

Q 

Are  you  familiar  with  other  litigation 

7 

concerning 

Section  702? 

8 

A 

I  am . 

9 

Q 

What  other  litigation  are  you  familiar 

10 

with? 

11 

A 

There's  at  least  one  other  lawsuit 

12 

having  to 

do  --  that  goes  back  quite  a  few  years. 

13 

sometimes 

referred  to  as  the  Jewel  litigation. 

14 

Q 

Okay.  So  what's  your  current  position 

15 

at  the  NSA? 

16 

A 

I'm  the  Director  of  the  Civil 

17 

Liberties , 

Privacy,  and  Transparency  Office. 

18 

Q 

How  long  have  you  been  in  that 

19 

position? 

20 

A 

A  little  over  four  years . 

21 

Q 

What  are  your  roles  and 

22 

responsibilities  in  that  position? 
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A  I  set  up  the  office  four  years  ago. 

Page  25 

2 

and  I  report  directly  to  the  Director  of  NSA.  I'm 

3 

an  adviser  on  civil  liberties,  privacy. 

4 

transparency  issues  to  both  the  Director,  as  well 

5 

as  our  Senior  Leadership  Team. 

6 

I  review  programs  to  identify  civil 

7 

liberties  and  privacy  risks.  I  identify  ways  to 

8 

mitigate  them.  I  also  work  on  transparency 

9 

issues,  publishing  reports,  meeting  with  civil 

10 

society/non-governmental  organizations,  and  then 

11 

also  act  as  the  privacy  advocate  for  NSA  agency 

12 

employees . 

13 

Q  Are  you  responsible  for  that  office's 

14 

oversight  of  upstream  surveillance? 

15 

A  Could  you  clarify?  I'm  not  sure  what 

16 

you  mean  by  oversight  of  that. 

17 

Q  Sure .  Are  you  involved  in  your 

18 

position  in  reviewing  the  operation  of  upstream 

19 

surveillance  as  part  of  that  office's  mission? 

20 

MR.  PATTON:  Objection,  vague. 

21 

You  can  answer. 

22 

THE  WITNESS:  My  office  reviews  the 
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compliance  incidents  or  other  reports,  oversight 

Page  26 

2 

reports,  as  part  of  our  role  as  information  goes 

3 

from  NSA  to  ODNI . 

4 

BY  MR.  ABDO: 

5 

Q  I  just  want  to  clarify  that  last 

6 

portion.  You  said  as  part  of  your  role. 

7 

information  goes  from  -- 

8 

A  ODNI.  So  --  sorry. 

9 

Our  office  is  at  a  more  strategic 

10 

level,  so  we  do  not  review  every  single  compliance 

11 

incident  or  every  single  activity  specifically. 

12 

We  have  a  compliance  group  that  does  those  types 

13 

of  functions. 

14 

My  office  is  more  strategic,  so  as 

15 

specific  reports  or  assessments  are  conducted 

16 

either  by  ODNI  or  the  Department  of  Justice,  we're 

17 

in  that  review  process. 

18 

I'm  also  the  main  interlocutor  with 

19 

the  Privacy  and  Civil  Liberties  Oversight  Board, 

20 

so  to  the  extent  that  there  are  compliance 

21 

incidences  or  changes  to  what  --  any  changes  to 

22 

how  NSA  is  conducting  its  mission  as  it  relates  to 
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counterterrorism,  we  provide  that  type  of 
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2 

information  and  those  types  of  briefings  to  the 

3 

PCLOB. 

4 

Q  So  in  that  role,  you're  not  involved 

5 

in  the  implementation  of  upstream  surveillance? 

6 

MR.  PATTON:  Objection,  vague. 

7 

THE  WITNESS:  So  certainly  at  the  — 

8 

there  are  decisions  that  are  being  made,  we're 

9 

informed,  we  will  help  decide,  help  with  providing 

10 

recommendations  about  whether  it  should  go  A  or  B 

11 

or  C,  depending  on  specific  questions  that  arise. 

12 

I'm  not  sure  I'm  answering  your  --  I'm 

13 

not  sure  I'm  fully  understanding  what  you're 

14 

trying  to  get  at. 

15 

BY  MR.  ABDO: 

16 

Q  Let  me  try  to  be  clear. 

17 

When  the  government  applies  for 

18 

authority  from  the  Eoreign  Intelligence 

19 

Surveillance  Court  to  conduct  upstream 

20 

surveillance,  is  your  office  involved  in  that 

21 

process? 

22 

A  Yes . 
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1 

Q  And  what's  the  nature  of  your  office's 
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2 

involvement  in  that  process? 

3 

A  We  review  the  minimum  --  the 

4 

proposed  --  we  will  review  any  of  the  procedures. 

5 

We  will  review  any  of  the  materials  to  ensure  that 

6 

we  think  that  privacy  has  been  properly  protected. 

7 

and  civil  liberties. 

8 

Q  And  that  review  happens  prior  to 

9 

submission  of  an  application  to  the  Foreign 

10 

Intelligence  Surveillance  Court? 

11 

MR.  PATTON:  Objection,  vague. 

12 

You  can  answer. 

13 

THE  WITNESS:  Ask  the  question  again. 

14 

BY  MR.  ABDO: 

15 

Q  Sure.  When  the  government  is  applying 

16 

for  authority  to  conduct  surveillance  under 

17 

Section  702  of  FISA  --  are  you  familiar  with  the 

18 

shorthand  FISA  for  Foreign  Intelligence 

19 

Surveillance  Act? 

20 

A  I  am . 

21 

MR.  PATTON:  Could  I  just  interrupt? 

22 

I  keep  objecting  to  vague  because 
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we're  talking  about  702,  but  there's  PRISM  and 

Page  2  9 

2 

Upstream,  and  so  if  you  want  to  be  more  specific. 

3 

that's  the  nature  of  my  objection. 

4 

MR.  ABDO:  That's  helpful.  Thanks, 

5 

Rodney . 

6 

BY  MR.  ABDO: 

7 

Q  When  the  government  is  applying  for 

8 

authority  to  conduct  upstream  surveillance  from 

9 

the  Foreign  Intelligence  Surveillance  Court,  does 

10 

your  office  review  those  applications  prior  to 

11 

their  submission  to  the  Foreign  Intelligence 

12 

Surveillance  Court? 

13 

A  I  understand.  Hold  on.  Sorry,  I'm 

14 

looking  for  something  specific  to  make  sure  I'm  -- 

15 

MR.  PATTON:  Take  your  time. 

16 

THE  WITNESS:  Can  I  talk  —  take  a 

17 

break  to  make  sure? 

18 

MR.  PATTON:  Sure. 

19 

BY  MR.  ABDO: 

20 

Q  I  just  want  to  be  clear.  Just  two 

21 

quick  things.  Could  you  please  first  identify 

22 

what  you're  looking  at  just  for  the  record? 
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A  I'm  looking  at  the  Objections  and 

Page  30 

2 

Responses  by  Defendant  National  Security  Agency 

3 

and  Admiral  Michael  S.  Rogers,  Director, 

4 

Plaintiffs'  First  and  Second  Sets  of  Requests  for 

5 

Admission . 

6 

Q  And  could  you  tell  us  whether  you're 

7 

looking  to  take  a  break  to  discuss  classified 

8 

versus  unclassified  information,  or  something 

9 

else?  Are  you  looking  to  discuss  with  your 

10 

counsel  the  line  between  classified  and 

11 

unclassified  information? 

12 

A  Yes . 

13 

Q  Okay.  I  think  let  me  actually  just 

14 

withdraw  that  question.  I  don't  think  we  need  to 

15 

take  the  time  to  go  there. 

16 

MR.  PATTON:  Just  to  be  clear  to 

17 

Mr.  Abdo ' s  point,  the  purpose  of  taking  a  break  is 

18 

not  to  talk  about  whatever  the  response  is  if  it's 

19 

not  a  subject  of  privilege. 

20 

The  time  to  take  a  break  and  the  need 

21 

to  take  a  break  is  related  to  whether  to  assert 

22 

the  privilege,  and  the  nature  and  scope  of  the 

TransPerfect  Legal  Solutions 
212-400-8845  -  Depo@TransPerfect.com 


OlgiaeaiI555XZ^jQO06B2FEEE  DBoPoreBtilSSStS  FffflddLQMafl^aS  PB§gdL3B  of  4098 


1 

privilege . 

Page  31 

2 

MR.  ABDO:  Thanks. 

3 

BY  MR.  ABDO: 

4 

Q 

You  said  that  you  had  been  in  your 

5 

current  position  for  four  and  a  half  years? 

6 

A 

Yes . 

7 

Q 

Before  that,  were  you  also  with  the 

8 

federal  government? 

9 

A 

Yes . 

10 

Q 

And  what  position  did  you  hold  before 

11 

your  current  one? 

12 

A 

I  was  the  Senior  Director  for  Privacy 

13 

Compliance 

at  the  Department  of  Homeland  Security 

14 

in  the  Privacy  Office. 

15 

Q 

How  long  were  you  in  that  position? 

16 

A 

Just  shy  of  ten  years . 

17 

Q 

And  what  were  your  roles  and 

18 

responsibilities  there? 

19 

A 

I  was  in  charge  of  developing  the 

20 

Privacy  Impact  Assessment  process,  publishing 

21 

Privacy  Act 

System  of  Records  Notices,  ensuring 

22 

that  the  review  of  all  IT  systems  within  the 
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Department  of  Homeland  Security  had  been  reviewed 

Page  32 

2 

for  privacy  considerations. 

3 

Q  As  part  of  that  job,  were  you  involved 

4 

in  any  way  in  upstream  surveillance? 

5 

A  No. 

6 

Q  As  far  as  you  know,  did  your  roles  or 

7 

responsibilities  in  that  job  have  any  bearing  on 

8 

this  lawsuit? 

9 

A  No,  not  to  the  best  of  my  knowledge. 

10 

Q  Can  you  just  briefly  explain  what  a 

11 

Privacy  Impact  Assessment  is? 

12 

A  Sure.  It's  a  requirement  of  both  the 

13 

E-Government  Act  of  2002,  as  well  as  the  Homeland 

14 

Security  Act,  Section  222,  which  requires  that  the 

15 

chief  privacy  officer  ensure  technology  sustains 

16 

and  does  not  erode  privacy. 

17 

It's  the  process  by  which  the 

18 

Department  of  Homeland  Security  and  other  federal 

19 

agencies  review  technology  to  ensure  they 

20 

understand  what  the  impact  would  be  on  privacy  and 

21 

how  they  might  be  able  to  mitigate  it. 

22 

It's  also  a  transparency  document  to 
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allow  the 

public  to  know  and  understand  what  the 
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2 

agency  is 

doing  with  their  information. 

3 

Q 

And  you  were  involved  in  the  issuance 

4 

of  those 

sorts  of  assessments  when  you  were  at  the 

5 

Department  of  Homeland  Security? 

6 

A 

Yes . 

7 

Q 

Prior  to  holding  that  position,  were 

8 

you  also 

in  the  federal  government? 

9 

A 

No.  I  worked  for  a  small  nonprofit 

10 

called  TRUSTe,  which  at  the  time  was  a  nonprofit 

11 

reviewing 

privacy  policies  and  issuing  seals  of 

12 

approval 

at  the  bottom  of  websites  --  or  generally 

13 

seen  at  the  bottom  of  websites,  indicating  that 

14 

the  privacy  policy  can  be  trusted. 

15 

Q 

How  long  were  you  in  that  position? 

16 

A 

I  think  about  three  years,  maybe  a 

17 

little  more,  maybe  a  little  less. 

18 

Q 

Were  the  two  jobs  within  the  federal 

19 

government  that  you've  discussed  so  far  the  only 

20 

two  jobs 

you've  held  in  the  federal  government? 

21 

A 

No.  Prior  to  working  at  TRUSTe,  I 

22 

worked  at 

the  Department  of  Commerce  in  the 
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e-commerce 

task  force  helping  to  negotiate  the 

Page  34 

2 

Safe  Harbor 

Accord,  which  is  the  privacy  agreement 

3 

between  the 

European  Commission  and  the  Department 

4 

of  Commerce 

for  companies  regulated  by  the  federal 

5 

Trade  Commission  or  the  Department  of 

6 

Transportation  to  be  able  to  transfer  data  from 

7 

the  EU  to  the  US  if  they've  agreed  to  a  set  of 

8 

privacy  policies. 

9 

Q 

What  was  your  position  then? 

10 

A 

I  was  the  intern. 

11 

Q 

How  long  did  you  have  that  internship? 

12 

MR.  PATTON:  Don't  knock  it. 

13 

THE  WITNESS:  Don't  knock  it,  man. 

14 

MR.  ABDO:  We  all  did. 

15 

THE  WITNESS:  I  was  there  for  a  year. 

16 

During  that 

time  frame,  I  went  from  being  there 

17 

called  a  co 

-op  student,  which  means  I  was  paid,  to 

18 

a  full-time 

employee . 

19 

BY  MR.  ABDO: 

20 

Q 

But  the  full  time  you  were  there  was 

21 

one  year? 

22 

A 

Yeah . 
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1 

Q  Okay.  Is  that  the  only  other  job 

Page  35 

2 

you've  had  in  the  federal  government? 

3 

A  Yes . 

4 

Q  Did  that  job  in  any  way  concern 

5 

upstream  surveillance? 

6 

A  No.  It  was  before  upstream 

7 

surveillance  existed. 

8 

Q  Can  you  describe  your  training  in  the 

9 

areas  of  computer  science,  computer  engineering. 

10 

telecommunications  networks,  or  network 

11 

surveillance  prior  to  joining  the  NSA? 

12 

A  I  do  not  have  -- 

13 

MR.  PATTON:  Object.  Object  to  form. 

14 

relevance . 

15 

MR.  ABDO:  You  can  answer. 

16 

MR.  PATTON:  You  can  answer. 

17 

THE  WITNESS:  Okay.  I  don't  have  any 

18 

specific  training  on  those  four  topics  prior  to 

19 

being  at  NSA. 

20 

BY  MR.  ABDO: 

21 

Q  Do  you  have  any  formal  technical 

22 

training  from  your  --  let  me  try  to  be  clear. 

TransPerfect  Legal  Solutions 
212-400-8845  -  Depo@TransPerfect.com 


OlgiaeaiI555xz^jQO06B2FEEE  DBoPoreBtilSSStS  FffflddLQMafl^aS  PBggdL3I  of  4098 


1 

Do  you  have  any  training  with  respect 

Page  36 

2 

to  those  four  topics  through,  you  know,  college  or 

3 

any  other  graduate  programs? 

4 

A  No,  I  do  not. 

5 

Q  Do  you  have  any  familiarity  with  those 

6 

topics  from  your  time  prior  to  joining  the  NSA? 

7 

MR.  PATTON:  Objection,  vague. 

8 

THE  WITNESS:  Certainly  my  experience 

9 

of  working  on  Privacy  Impact  Assessments  at  the 

10 

Department  of  Homeland  Security,  as  well  as 

11 

working  through  different  Internet  activities,  has 

12 

given  me  a  great  deal  of  on-the-job  experience. 

13 

I  have  no  formal  training  to  speak  of 

14 

in  computer  science  or  the  other  topics  you've 

15 

mentioned . 

16 

BY  MR.  ABDO: 

17 

Q  Can  you  describe  the  on-the-job 

18 

training  you  got  in  your  position  at  the 

19 

Department  of  Homeland  Security  on  those  four 

20 

topics?  And  let  me  just  be  clear,  on  the  topics 

21 

of  computer  science,  computer  engineering. 

22 

telecommunications  networks,  or  network 

TransPerfect  Legal  Solutions 
212-400-8845  -  Depo@TransPerfect.com 


OlgiaeaiI555xz^jQO06B2FEEE  DBoPoreBtilSSStS  FffflddLQMafl^aS  PBggdL38  of  4098 


1 

surveillance . 

Page  37 

2 

A  The  first  three  are  all  part  of  the 

3 

process  by  which  we  were  having  to  review 

4 

extensively  the  types  of  technology  that  DHS  was 

5 

putting  forward  and  better  understanding  them  to 

6 

ensure  we  understood  the  privacy  implications.  So 

7 

how  did  the  computer  systems  work?  Sort  of  how 

8 

was  the  information  being  moved?  Where  was  the 

9 

information  being  moved? 

10 

I  have  no  formal  experience  beyond  my 

11 

work  at  NSA  on  network  surveillance. 

12 

Q  For  your  time  still  at  the  Department 

13 

of  Homeland  Security,  would  you  consult  with 

14 

technologists  to  better  understand  how  the  conduct 

15 

that  you  were  reviewing  might  impact  privacy? 

16 

A  Absolutely. 

17 

Q  Was  that  a  frequent  part  of  your  job? 

18 

A  Yes.  We  worked  very  closely  with  the 

19 

chief  information  officer,  the  chief  information 

20 

security  officer. 

21 

We  also  had  external  experts  to  the 

22 

Department  of  Homeland  Security  who  did  have 
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experience  in  all  of  these  different  topics  who 

Page  38 

2 

would  provide  external  expertise  as  part  of  the 

3 

Federal  Advisory  Committee  Act,  or  FACA. 

4 

All  of  those  were  available  if  we  had 

5 

questions  to  ensure  that  both  we  were  fully 

6 

understanding  the  privacy  impact,  that  we  had  an 

7 

appreciation  of  the  information  we  needed  to,  and 

8 

were  getting  those  expertise  from  across  -- 

9 

wherever  in  DHS  we  needed. 

10 

Q  You  said  that  network  surveillance  was 

11 

not  a  topic  on  which  you  received  on-the-job 

12 

training  during  your  time  at  DHS? 

13 

A  Correct. 

14 

Q  Is  that  because  there  were  no  network 

15 

surveillance  programs  that  your  office  was  called 

16 

upon  to  review  at  your  time  at  DHS? 

17 

MR.  PATTON:  Objection. 

18 

THE  WITNESS:  I  need  — 

19 

MR.  PATTON:  Just  a  second. 

20 

Objection.  I'm  not  sure  of  the 

21 

relevance  of  that  particular  question,  but  besides 

22 

that,  it  is  vague,  ambiguous,  but  the  witness  can 
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1 

answer . 

Page  39 

2 

THE  WITNESS:  We're  now  hitting  into 

3 

an  area  of  classification  that  I  would  need  to  go 

4 

and  discuss  any  further  conversation  on  this 

5 

having  to  do  with  DHS  activities. 

6 

BY  MR.  ABDO: 

7 

Q  Let  me  take  a  step  back  then. 

8 

You  said  before  that  you  hadn't 

9 

received  any  on-the-job  training  with  respect  to 

10 

network  surveillance  during  your  time  at  DHS. 

11 

That's  correct,  right? 

12 

A  Maybe  a  better  way  would  be  if  you 

13 

could  explain  what  you  mean  by  "network 

14 

surveillance, "  and  then  I  can  better  answer  that 

15 

question . 

16 

Q  Sure.  I  mean  the  use  of  computers  to 

17 

monitor  communications  over  a  telecommunications 

18 

network . 

19 

A  I  think  what  I  would  like  to  do  is 

20 

revise  what  my  answer  is  to  say  that,  yes,  I  did 

21 

have  on-the-job  training  associated  with  that,  and 

22 

to  go  any  further  into  that  likely  is  classified. 
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Q  Okay.  I  don't  think  we  need  to  go 

Page  40 

2 

further . 

3 

A  Okay. 

4 

Q  I  just  wanted  to  understand  the  nature 

5 

of  your  technical  training  prior  to  your  joining 

6 

the  NSA. 

7 

A  Okay. 

8 

Q  So  now  let's  move  to  your  time  at  the 

9 

NSA.  Can  you  describe  in  unclassified  terms  your 

10 

on-the-job  training  with  respect  to  those  four 

11 

areas,  which  again  are  computer  science,  computer 

12 

engineering,  telecommunications  networks,  or 

13 

network  surveillance? 

14 

MR.  PATTON:  Objection  to  the  question 

15 

to  the  extent  it  calls  for  source  and  methods  of 

16 

the  NSA,  operational  details  of  Upstream,  which 

17 

are  protected  by  the  state  secrets  privilege  and 

18 

50  U.S.C.  §  3605(a),  50  U.S.C.  §  3024(i)(l). 

19 

The  witness  can  answer  the  question  to 

20 

the  extent  that  it's  unclassified. 

21 

MR.  ABDO:  And  to  be  clear  here,  I'm 

22 

asking  just  for  unclassified  information. 
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1 

And,  Rodney,  can  we  agree  on  a  short 

Page  41 

2 

form  of  your  invocation  of  the  state  secrets 

3 

privilege  and  the  other  two  statutory  claims  of 

4 

protection? 

5 

MR.  PATTON:  I  will  work  on  that.  We 

6 

can  maybe  make  a  deal  that  you  will  shorten  your 

7 

record  and  I'll  shorten  mine. 

8 

But  my  concern  with  in  unclassified 

9 

terms  is  it  may  be  very  difficult  for  the  witness 

10 

to  separate  out  when  it's  a  broad  question  like 

11 

that  as  opposed  to  a  very  specific  question. 

12 

MR.  ABDO:  If  instead  of  using  the 

13 

term  "classified"  we  used  the  term  "protected, " 

14 

would  that  be  clearer? 

15 

MR.  PATTON:  For  me  I  think  it's  just 

16 

the  tell  me  about  everything  nature  of  the 

17 

question,  which  is  very  difficult  for  her  to  come 

18 

up  with  what  is  classified  and  what  is 

19 

unclassified  on  the  spot,  whereas  specific 

20 

questions  are  much  easier  where  she's  --  you  know. 

21 

her  job  is  to  know  where  the  line  is,  and  she 

22 

knows  where  the  line  is. 
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1 

This  is  asking  about  her  entire  thing. 

Page  42 

2 

so  that's 

my  concern. 

3 

BY  MR.  ABDO: 

4 

Q 

Ms.  Richards,  do  you  think  you  can 

5 

answer  my 

question  without  disclosing  classified 

6 

information? 

7 

A 

I  can  answer.  I'm  not  sure  it  will 

8 

give  you  what  you're  looking  for,  but  . . . 

9 

Q 

Why  don't  we  start  with  what  you  can 

10 

do . 

11 

A 

My  answer  is  I  have  extensive  ability 

12 

to  talk  to 

and  learn  from  anyone  within  NSA  about 

13 

how  we  do 

our  job.  To  the  extent  that  it  means 

14 

I'm  interacting  with  people  in  all  four  of  those 

15 

categories 

,  that ' s  what  I  do . 

16 

Q 

Do  you  consider  yourself  to  be  well 

17 

technically  versed  or  conversant  in  those  four 

18 

areas? 

19 

MR.  PATTON:  Object  to  the  form. 

20 

MR.  ABDO:  You  can  answer. 

21 

THE  WITNESS:  I  do. 

22 
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1 

BY  MR.  ABDO: 

Page  43 

2 

Q 

I  think  that's  fine. 

3 

As  part  of  your  job  at  NSA,  have  you 

4 

ever  been 

required  to  learn  technical  concepts 

5 

relating 

to  the  programs 

you  were  reviewing  that 

6 

you  felt 

unable  to  learn 

or  understand? 

7 

MR.  PATTON: 

Object  to  the  form. 

8 

THE  WITNESS: 

I  don't  understand  your 

9 

question. 

so  help  me. 

10 

BY  MR.  ABDO: 

11 

Q 

Sure,  yeah. 

Your  job  at  NSA  involves 

12 

reviewing 

NSA  surveillance  programs,  correct? 

13 

A 

Correct . 

14 

MR.  PATTON: 

Object  to  the  form. 

15 

THE  WITNESS: 

Correct . 

16 

BY  MR.  ABDO: 

17 

Q 

And  as  part 

of  reviewing  those 

18 

programs , 

you  mentioned 

that  you  talk  with  NSA 

19 

employees 

about  how  those  programs  work;  is  that 

20 

right? 

21 

A 

Yes  . 

22 

Q 

When  talking 

with  those  employees 
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1 

about  NSA  surveillance  programs,  have  you  ever 

Page  44 

2 

felt  unable  to  comprehend  technical  detail  that 

3 

you  were  being  explained? 

4 

MR.  PATTON:  Object  to  the  form. 

5 

vague.  You  can  answer. 

6 

THE  WITNESS:  No,  I  have  never  felt 

7 

like  I  couldn't  understand  what  they  were  saying. 

8 

or  what  the  concepts  that  they  were  explaining  to 

9 

me.  Is  that  what  you're  asking  me? 

10 

BY  MR.  ABDO: 

11 

Q  Yeah,  that's  what  I'm  asking  you. 

12 

A  Okay.  No,  I've  never  had  --  they  have 

13 

all  been  able  to  fully  explain  it,  both  in  concept 

14 

and  in  fact. 

15 

Q  Okay,  great. 

16 

(Deposition  Exhibit  42  was 

17 

marked  for  identification.) 

18 

BY  MR.  ABDO: 

19 

Q  Ms.  Richards,  you  now  have  in  front  of 

20 

you  what's  been  marked  as  Exhibit  42. 

21 

Do  you  recognize  Exhibit  42? 

22 

A  Yes,  I  do. 
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1 

Q 

What  is  it? 

Page  45 

2 

A 

It  is  Objections  and  Responses  by 

3 

Defendants 

National  Security  Agency  and  Admiral 

4 

Michael  F. 

Rogers,  Director,  to  Plaintiff's 

5 

Interrogatories . 

6 

Q 

Could  you  please  turn  to  page  17  of 

7 

Exhibit  42 

and  read  to  yourself  the  question 

8 

identified 

on  that  page  as  Interrogatory  No.  12? 

9 

A 

(Witness  reviewing  document.) 

10 

Q 

Have  you  had  a  chance,  Ms.  Richards, 

11 

to  read  just  the  interrogatory,  the  question 

12 

itself.  No 

.  12  on  page  17? 

13 

A 

I'm  sorry.  Yes,  I  have. 

14 

Q 

Could  you  turn  to  page  18  of  the  same 

15 

document , 

Exhibit  42,  and  read  the  paragraph  on 

16 

that  page 

identified  as  RESPONSE,  which  is  the 

17 

response  to  Interrogatory  No.  12  provided  by  the 

18 

NSA,  and  let  me  know  when  you're  done. 

19 

A 

(Witness  reviewing  document.)  Okay. 

20 

Q 

Did  you  have  any  role  in  drafting  or 

21 

reviewing 

the  NSA's  response  to  Interrogatory 

22 

No.  12? 

TransPerfect  Legal  Solutions 
212-400-8845  -  Depo@TransPerfect.com 


OigiaeaiI555xz^jQO06B2FEEE  DBoporeBtilSSStS  FffflddLQMafl^aS  PB§gdL5I  of  1098 


1 

MR.  PATTON:  Object  to  the  form,  vague 

Page  46 

2 

as  to  time. 

3 

THE  WITNESS:  No,  I  did  not. 

4 

BY  MR.  ABDO: 

5 

Q 

You  didn't  draft  the  response? 

6 

A 

I  did  not  draft  the  response. 

7 

Q 

Did  you  see  this  response  prior  to  its 

8 

having  been 

filed  in  federal  court  --  sorry,  prior 

9 

to  this  having  been  sent  to  the  Plaintiffs  in  this 

10 

lawsuit? 

11 

A 

No. 

12 

Q 

Since  this  response  was  provided  to 

13 

Plaintiff, 

have  you  reviewed  this  response? 

14 

A 

Yes . 

15 

Q 

And  do  you  understand  this  response? 

16 

A 

Yes . 

17 

Q 

To  your  understanding,  does  the  term 

18 

"Internet  backbone"  include  high-speed,  ultra-high 

19 

bandwidth  data  transmission  lines  between  the 

20 

networks  of 

major  Internet  service  providers? 

21 

MR.  PATTON:  Objection,  calls  for 

22 

expert  testimony  of  a  telecommunications  computer 
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expert.  You  can  answer. 

Page  47 

2 

THE  WITNESS:  Certainly  that  is  one 

3 

example  of  what  might  be  included  in  the  Internet 

4 

backbone . 

5 

BY  MR.  ABDO: 

6 

Q  When  you  say  --  what  do  you  mean  by 

7 

"might  be"? 

8 

A  Well,  as  is  noted  in  the  definition. 

9 

and  as  is  actually  when  it  first  comes  up  in  the 

10 

testimony  to  the  PCLOB,  Internet  backbone  is  a  -- 

11 

sort  of  for  want  of  a  better  word,  there's  not  a 

12 

specific  term  that  everyone  turns  to  and  says  that 

13 

is  the  Internet  backbone,  but  rather  is  a  general 

14 

description . 

15 

And  so  there  are  a  number  of  things. 

16 

as  is  described  here,  that  could  be  included  in 

17 

the  Internet  backbone.  It's  not  yes  or  no. 

18 

Q  But  your  understanding  is  that  the 

19 

high-speed,  ultra-high  bandwidth  data  transmission 

20 

lines  between  the  networks  of  major  Internet 

21 

service  providers  are  one  such  example? 

22 

A  Those  could  be  one  such  example. 
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Q  And  the  Internet  backbone  also 

Page  48 

2 

includes  high-speed,  ultra-high  bandwidth  data 

3 

transmission  lines  within  the  networks  of  major 

4 

Internet  service  providers? 

5 

MR.  PATTON:  Objection  to  form,  calls 

6 

for  expert  testimony.  You  can  answer. 

7 

THE  WITNESS:  You're  making  a 

8 

distinction  between  within  versus  -- 

9 

BY  MR.  ABDO: 

10 

Q  Between,  that's  right. 

11 

A  So  with  --  you're  -- 

12 

Q  Sorry.  My  first  set  of  questions 

13 

related  to  data  transmission  lines  between  the 

14 

networks  of  major  Internet  service  providers  --  in 

15 

other  words,  those  connecting  one  major  Internet 

16 

service  provider  to  another  --  and  now  I'm  asking 

17 

about  the  high-speed,  ultra-high  bandwidth  data 

18 

transmission  lines  within  any  given  major  Internet 

19 

service  provider. 

20 

MR.  PATTON:  Objection,  calls  for 

21 

expert  testimony.  You  can  answer. 

22 

THE  WITNESS:  It  certainly  may  be.  I 
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1 

wouldn't  say  --  it  could  be  an  example. 

Page  49 

2 

BY  MR.  ABDO: 

3 

Q  Can  you  give  other  examples  of 

4 

high-speed,  high  bandwidth  data  transmission  lines 

5 

that  would  be  part  of  the  Internet  backbone? 

6 

MR.  PATTON:  Objection,  calls  for 

7 

expert  testimony.  You  can  answer. 

8 

THE  WITNESS:  There's  the  terrestrial 

9 

and  undersea  circuits  are  other  examples. 

10 

BY  MR.  ABDO: 

11 

Q  Could  you  describe  just  a  little  bit 

12 

more  what  you  mean  by  those? 

13 

MR.  PATTON:  Same  objection. 

14 

THE  WITNESS:  So  both  with  Internet 

15 

backbone,  as  well  as  terrestrial  and  undersea 

16 

circuits,  NSA  doesn't  have  a  specific  NSA 

17 

definition.  It's  what  would  be  generally  accepted 

18 

by  a  telecom  expert.  So  there's  nothing  special 

19 

about  what  those  are. 

20 

BY  MR.  ABDO: 

21 

Q  And  I'm  not  asking  for  a  special 

22 

definition  of  Internet  backbone.  I'm  asking 
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1 

whether  your  understanding  of  that  term  would 

Page  50 

2 

encompass  the  sort  of  data  transmission  lines  we 

3 

were  just  discussing. 

4 

MR.  PATTON:  Objection  to  form,  vague. 

5 

and  calls  for  expert  opinion. 

6 

THE  WITNESS:  So  I  guess  my  answer 

7 

hasn't  changed,  and  to  go  any  further  would  put  us 

8 

into  classified  information. 

9 

And  so  to  the  extent  that  the 

10 

information  you  have  in  the  response  --  there's  no 

11 

additional  information  that  is  --  I  can  switch 

12 

words  around,  but  in  essence,  those  are  different 

13 

types  of  examples  that  could  be  part  of  what  the 

14 

Internet  backbone  is,  but  there's  no  additional 

15 

information  I  can  provide  to  you  that's  not 

16 

classified . 

17 

BY  MR.  ABDO: 

18 

Q  I  understand  that  you  may  not  be  able 

19 

to  provide  an  unclassified  response  to  this 

20 

question,  but  could  you  state  whether  the  NSA 

21 

considers  high-speed,  ultra-high  bandwidth  data 

22 

transmission  lines  between  and  within  the  networks 
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1 

of  major  Internet  service  providers  to  be  part  of 

Page  51 

2 

the  Internet  backbone  for  purposes  of  upstream 

3 

surveillance? 

4 

MR.  PATTON:  Objection,  asked  and 

5 

answered.  Objection,  calls  for  expert  testimony. 

6 

And  also  objection  that  it  is  calling  for 

7 

classified  information  and  information  protected 

8 

by  the  previously  mentioned  statutes,  so  I'll 

9 

instruct  the  witness  not  to  answer  that  question. 

10 

BY  MR.  ABDO: 

11 

Q  Are  you  going  to  follow  your  lawyer's 

12 

instruction  not  to  answer  the  question? 

13 

A  Yes . 

14 

MR.  ABDO:  Rodney,  can  we  agree  that 

15 

every  time  you  instruct  Ms.  Richards  not  to  answer 

16 

a  question  on  the  basis  of  its  classification,  you 

17 

will  consider  us  to  have  noted  our  objection  to  it 

18 

and  we  can  move  on? 

19 

MR.  PATTON:  Absolutely. 

20 

MR.  ABDO:  Okay. 

21 

MR.  PATTON:  I  mean,  there  may  be 

22 

other  ways  to  ask  the  question  to  get  around  that. 
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1 

That's  part  of  the  problem. 

Page  52 

2 

MR.  PADGETT:  Maybe  we  should  take  a 

3 

break  because  I  think  there  is  something  that 

4 

could  be  said,  but  the  question  is  throwing  it 

5 

of  f . 

6 

MR.  PATTON:  Right,  that's  what  I  was 

7 

just  saying.  There  may  be  an  answer  to  the 

8 

question,  depending  on  how  it's  phrased,  that  we 

9 

could  provide  an  unclassified  response,  and  so  we 

10 

want  to  try  and  provide  as  much  of  an  unclassified 

11 

response  as  possible,  but  the  way  the  question  is 

12 

framed  leads  us  into  a  classified  area. 

13 

MR.  ABDO:  Let  me  try  to  ask  it  one 

14 

other  way. 

15 

BY  MR.  ABDO: 

16 

Q  Is  your  understanding  that 

17 

telecommunications  networks  experts  would  consider 

18 

the  high-speed,  high-bandwidth  data  transmission 

19 

lines  between  and  within  the  networks  of  major 

20 

Internet  service  providers  to  be  part  of  the 

21 

Internet  backbone? 

22 

MR.  PATTON:  Just  take  a  pause. 
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1 

(Counsel  conferring.) 

Page  53 

2 

MR.  PATTON:  Just  object  to  the  form 

3 

in  terms  of  calling  for  expert  testimony,  but  you 

4 

can  answer  that  question. 

5 

Do  you  need  the  question  read  back? 

6 

MR.  ABDO:  We  can  do  that  if  that's 

7 

easier . 

8 

THE  WITNESS:  Yeah,  can  you  read  the 

9 

question  one  more  time?  Sorry.  Too  many  things. 

10 

(The  reporter  read  back  the  question.) 

11 

THE  WITNESS:  I  think  generally 

12 

speaking,  yes. 

13 

MR.  ABDO:  Rodney,  if  you  want  to  take 

14 

a  --  if  there's  more  you  think  that  can  be 

15 

provided  after  a  short  break,  we're  happy  to  do 

16 

that  now. 

17 

MR.  PADGETT:  It  might  be  helpful. 

18 

MR.  GILLIGAN:  Actually,  30  seconds. 

19 

MR.  ABDO:  Go  off  the  record. 

20 

(Off  the  record  at  10:02  a.m.) 

21 

(Resume  at  10:05  a.m.) 

22 

MR.  PATTON:  So  we've  clarified  the 
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lines  as  to  where  the  privileged  information  in 

Page  54 

2 

that  line  of  questioning  is,  so  you  can  ask  your 

3 

next  question,  hopefully  get  a  response. 

4 

BY  MR.  ABDO: 

5 

Q  Sure.  Is  there  a  way  that  I  could 

6 

have  asked  the  last  set  of  questions  I  was  asking 

7 

in  a  way  that  you  could  answer  with  unclassified 

8 

information? 

9 

A  To  the  extent  the  term  "Internet 

10 

backbone"  is  what  is  generally  understood,  as 

11 

amorphous  as  that  definition  is,  by  a 

12 

telecommunications  expert,  that's  how  NSA  would 

13 

describe  it. 

14 

To  the  extent  you  are  connecting  it  in 

15 

some  way  to  upstream,  that's  where  you  get  to 

16 

classified  information. 

17 

So  they're  sort  of  differentiating 

18 

between  those  two,  but  NSA  doesn't  have  a  special 

19 

definition . 

20 

Q  Right.  And  I  think  you  answered  the 

21 

question  with  respect  to  the  term  "Internet 

22 

backbone"  as  understood  by  telecommunications 
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networks  professionals  or  experts,  but  just  to  be 

Page  55 

2 

clear,  that  term,  as  used  by  telecommunications 

3 

networks  experts,  includes  the  high-speed. 

4 

ultra-high  bandwidth  data  transmission  lines 

5 

between  and  within  the  networks  of  major  Internet 

6 

service  providers,  right? 

7 

A  Yes . 

8 

MR.  PATTON:  Objection  to  the  extent 

9 

it  calls  for  an  expert  opinion. 

10 

THE  WITNESS:  But  generally  yes,  that 

11 

would  be  what  I  believe  they  would  say,  and  so 

12 

that  would  be  what  NSA  would  say. 

13 

BY  MR.  ABDO: 

14 

Q  Okay.  Going  back  to  the  NSA's 

15 

response  to  Interrogatory  12,  what  does  the  term 

16 

"data  transmission  lines"  refer  to? 

17 

MR.  PATTON:  Objection,  calls  for 

18 

expert  opinion. 

19 

THE  WITNESS:  Lines  that  transmit 

20 

data.  I  mean,  beyond  what  a  tele-  --  so  I'm  not  a 

21 

telecommunications  expert,  as  we've  noted.  That 

22 

doesn't  mean  I  don't  understand  how  they  work,  but 
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1 

there's  no  special  definition  here  that  is 

Page  56 

2 

distinct  to  what  NSA  does. 

3 

BY  MR.  ABDO: 

4 

Q  What  I'm  getting  at  is  does  the  term 

5 

"data  transmission  lines"  refer  to  the  physical 

6 

means  of  transmission  of  data,  or  something  else? 

7 

MR.  PATTON:  Same  objection. 

8 

THE  WITNESS:  I  will  go  back  to  that 

9 

it  has  no  special  particular  meaning  beyond  what  a 

10 

telecommunications  expert  would  expect. 

11 

BY  MR.  ABDO: 

12 

Q  Is  your  understanding  that  a 

13 

telecommunications  network  expert  will  use  that 

14 

term,  "data  transmission  lines,"  to  refer  to  a 

15 

physical  means  of  transmission,  such  as,  for 

16 

example,  a  cable  or  a  wire  or  an  optical  fiber? 

17 

MR.  PATTON:  Object.  Object  to  the 

18 

form,  vague,  and  calls  for  expert  testimony. 

19 

You  can  answer. 

20 

THE  WITNESS:  As  opposed  to? 

21 

BY  MR.  ABDO: 

22 

Q  As  opposed  to  logical  or  virtual 
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1 

groupings  of  data  transmitted  from  one  point  to 

Page  57 

2 

another . 

3 

MR.  PATTON:  Same  objections. 

4 

BY  MR.  ABDO: 

5 

Q  I'm  really  just  trying  to  understand 

6 

the  term  that  you've  used  in  your  response  to 

7 

Interrogatory  No.  12,  and  the  term  is  "data 

8 

transmission  lines,"  and  what  I'm  trying  to 

9 

understand  is  whether  that  refers  to  physical 

10 

lines  of  transmitting  data,  or  other  ways  of 

11 

transmitting  --  other  ways  of  understanding  the 

12 

transmission  of  data. 

13 

A  Oh,  okay. 

14 

Q  Do  you  understand  that  question  and 

15 

what  I'm  trying  to  understand? 

16 

A  Do  you  want  to  go  a  little  further? 

17 

What  would  be  the  --  I  guess  I'm  tripping  over 

18 

this  seems  to  be  logical  on  its  face,  and  so  I'm 

19 

not  sure  --  I'm  having  a  hard  time  --  it  sort  of 

20 

defines  itself,  so  ... 

21 

Q  So  in  another  interrogatory  response. 

22 

the  NSA  uses  the  term  "virtual  circuit."  I'm 
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1 

trying  to  understand  whether  this  term,  "data 

Page  58 

2 

transmission  lines,"  is  limited  to  physical 

3 

transmission  lines  or  something  else,  like  virtual 

4 

circuits  ? 

5 

MR.  PATTON:  Object  to  the  form,  calls 

6 

for  expert  testimony. 

7 

THE  WITNESS:  Do  you  want  to  point  to 

8 

where  virtual  circuits  is  so  I  can  make  sure  I'm 

9 

not  tripping  up  or  --  I  do  remember  seeing  virtual 

10 

circuits,  I  just  don't  -- 

11 

BY  MR.  ABDO: 

12 

Q  Turn  to  page  -- 

13 

A  I  want  to  make  sure  I'm  looking  at  the 

14 

same  one  that  you're  looking  at. 

15 

Q  If  you  turn  to  page  6  of  Exhibit  42, 

16 

it's  the  response  to  Interrogatory  No.  2, 

17 

designated  on  that  page  by  the  all  caps  word 

18 

RESPONSE . 

19 

Do  you  want  to  take  a  second  to  read 

20 

those  two  paragraphs  to  yourself? 

21 

A  Yeah.  (Witness  reviewing  document.) 

22 

Oh,  okay. 
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1 

Q  Having  read  that,  do  you  now 

Page  59 

2 

understand  what  I'm  asking  with  respect  to  the 

3 

term  "data  transmission  lines"? 

4 

A  Yeah,  it's  physical  data  transmission 

5 

lines.  There's  nothing  --  there's  nothing  virtual 

6 

or  --  there's  nothing  --  it's  a  physical 

7 

transmission  line. 

8 

Q  Okay,  okay.  Would  a  fiberoptic  cable 

9 

qualify  as  a  data  transmission  line  as  that  term 

10 

is  understood  by  telecommunications  network 

11 

experts  ? 

12 

MR.  PATTON:  Objection,  calls  for 

13 

testimony  by  a  telecommunications  expert. 

14 

You  can  answer. 

15 

THE  WITNESS:  Yes,  it  would.  That 

16 

would  be  one  example.  I'm  not  saying  that's  the 

17 

only  example,  but  it's  certainly  an  example  of 

18 

what  might  be  included  in  that. 

19 

BY  MR.  ABDO: 

20 

Q  Okay.  Would  it  also  include  --  let  me 

21 

phrase  the  question  fully. 

22 

Would  the  term  "data  transmission 
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line"  also  include  optical  fibers  within  a 

Page  60 

2 

fiberoptic  cable  as  that  term  is  used  by 

3 

telecommunications  networks  and  network 

4 

professionals  ? 

5 

MR.  PATTON:  Objection  to  the  extent 

6 

it  calls  for  testimony  by  those  telecommunications 

7 

experts.  You  can  answer. 

8 

THE  WITNESS:  To  the  extent  that's  an 

9 

example  of  what  might  be  included  in  that,  yes. 

10 

BY  MR.  ABDO: 

11 

Q  Would  a  fiberoptic  cable  be  a  data 

12 

transmission  line  as  that  term  is  understood  by 

13 

the  NSA? 

14 

MR.  PATTON:  Same  objection. 

15 

THE  WITNESS:  Can  you  repeat  the 

16 

question?  I'm  not  sure  I  understood. 

17 

BY  MR.  ABDO: 

18 

Q  Sure.  Does  the  term  "data 

19 

transmission  line, "  as  the  NSA  has  used  it  in 

20 

response  to  Interrogatory  12,  include  fiberoptic 

21 

cables  ? 

22 

MR.  PATTON:  Objection  to  the  extent 
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it  calls  for  expert  testimony.  You  can  answer. 

Page  61 

2 

THE  WITNESS:  Yes. 

3 

BY  MR.  ABDO: 

4 

Q  Okay.  And  the  same  is  true  of  -- 

5 

A  It's  an  example.  I  mean,  all  of  these 

6 

are  examples.  NSA  doesn't  have  a  special 

7 

definition  for  "Internet  backbone"  or  these  other 

8 

well-known  telecom-like  words  that  you're  bringing 

9 

up,  data  transmission  line  or  fiberoptic  line. 

10 

Q  Does  the  term  "data  transmission 

11 

line,"  again  as  used  in  the  response  to 

12 

Interrogatory  12,  include  individual  wavelengths 

13 

of  light  carried  over  fiberoptic  cables? 

14 

MR.  PATTON:  Object  to  the  form  to  the 

15 

extent  it  calls  for  expert  testimony. 

16 

You  can  answer. 

17 

THE  WITNESS:  Certainly  it  is  an 

18 

example . 

19 

BY  MR.  ABDO: 

20 

Q  Would  the  term  include  any 

21 

subdivisions  of  a  wavelength  of  light  carried  over 

22 

a  fiberoptic  cable? 
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1 

MR.  PATTON:  Same  objections. 

Page  62 

2 

You  can  answer. 

3 

THE  WITNESS:  Would  the  subdivision  of 

4 

the  light? 

5 

BY  MR.  ABDO: 

6 

Q  Would  any  subdivisions  of  a  wavelength 

7 

of  light  carried  over  a  fiberoptic  cable 

8 

constitute  a  data  transmission  line  as  the  NSA  has 

9 

used  that  term  in  responding  to  Interrogatory  12? 

10 

MR.  PATTON:  Objection  to  the  extent 

11 

it  calls  for  expert  testimony.  You  can  answer. 

12 

THE  WITNESS:  So  to  the  extent  that 

13 

any  of  those  are  an  example  of  what  might  be  part 

14 

of  the  Internet  backbone,  in  which  case  it's 

15 

providing  high-speed,  ultra-high  bandwidth  data 

16 

transmission  lines,  the  answer  would  be  yes. 

17 

MR.  ABDO:  Okay.  Do  you  mind  if  we 

18 

take  a  five-minute  break  to  use  the  restroom? 

19 

MR.  PATTON:  No. 

20 

(A  break  was  taken  at  10:15  a.m.) 

21 

(Resume  at  10:25  a.m.) 

22 
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1 

BY  MR.  ABDO: 

Page  63 

2 

Q  Ms.  Richards,  where  do  you  acquire 

3 

your  understanding  of  the  term  "Internet 

4 

backbone" ? 

5 

A  From  both  experts  within  NSA,  as  well 

6 

as  talking  to  --  or  actually  reading  what's,  you 

7 

know,  sort  of  been  written  on  it  in 

8 

telecommunications  just  sort  of  generally. 

9 

Q  Did  you  talk  to  anyone  at  the  NSA 

10 

about  the  meaning  of  the  term  "Internet  backbone" 

11 

in  preparing  for  this  deposition? 

12 

MR.  PATTON:  Objection  to  the  question 

13 

to  the  extent  it  calls  for  attorney-client 

14 

privilege  or  any  classified  information,  but  you 

15 

can  answer  to  the  extent  that  it  is  not 

16 

attorney-client  privileged. 

17 

THE  WITNESS:  Certainly  in  preparation 

18 

for  this  we  reviewed  the  definitions  that  have 

19 

been  provided  to  ensure  that  I  understood  them  and 

20 

that  nothing  had  changed. 

21 

BY  MR.  ABDO: 

22 

Q  Did  you  talk  with  any  subject  matter 
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experts  at 

the  NSA  about  the  meaning  of  the  term 

Page  64 

2 

" Internet 

backbone" ? 

3 

A 

Yes,  I  did. 

4 

Q 

Did  you  talk  to  them  about  anything 

5 

beyond  what  was  provided  by  the  NSA  in  response  to 

6 

Interrogatory  12  asking  for  the  definition  of 

7 

" Internet 

backbone" ? 

8 

MR.  PATTON:  Object  to  the  form. 

9 

vague . 

10 

THE  WITNESS:  We  discussed  the 

11 

definition 

and  understood  it  to  be  the  same  as  the 

12 

definition 

that  a  subject  matter  expert  in  the 

13 

telecommunications  industry  would  use. 

14 

I'm  not  sure  I'm  understanding  or 

15 

answering 

what  you're  asking  me. 

16 

BY  MR.  ABDO: 

17 

Q 

Did  you  talk  about  the  terms  used  in 

18 

the  definition  provided  of  the  term  "Internet 

19 

backbone" ? 

20 

A 

Yes . 

21 

Q 

You  understand  that  the  definition  of 

22 

the  term  " 

Internet  backbone"  is  one  of  the  terms 
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1 

listed  in  topic  2  of  the  deposition  notice  of  the 

Page  65 

2 

case? 

3 

A  Yes . 

4 

Q  And  you  understand  that  the  NSA  has  an 

5 

obligation  under  the  federal  rules  to  provide 

6 

somebody  for  this  deposition  who  knows  the 

7 

Agency's  understanding  of  that  term? 

8 

A  Yes . 

9 

MR.  PATTON:  Object  to  the  extent  it 

10 

calls  for  a  legal  conclusion. 

11 

Just  wait  for  my  objection  -- 

12 

THE  WITNESS:  Sorry. 

13 

MR.  PATTON:  --  or  non-objection. 

14 

BY  MR.  ABDO: 

15 

Q  So  you  understand  what  I'm  asking 

16 

about?  When  I'm  asking  about  the  NSA's 

17 

understanding  of  certain  terms,  I'm  asking  for  the 

18 

NSA's  understanding,  as  you're  a  designee  of  the 

19 

NSA  today. 

20 

A  Yes . 

21 

Q  Okay.  I  want  to  move  to  a  different 

22 

term  used  in  your  definition. 
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1 

The  definition  or  use  of  the  term 

Page  66 

2 

"large,  strategically  interconnected  computer 

3 

network, "  what  does  that  term  mean? 

4 

MR.  PATTON:  Objection  to  the  extent 

5 

it  calls  for  expert  testimony.  You  can  answer. 

6 

THE  WITNESS:  The  words  have  no 

7 

specific  meaning  beyond  what  you  would  expect  from 

8 

a  telecommunications  expert. 

9 

They're  large,  they're  strategically 

10 

connected,  and  they're  computer  networks.  Perhaps 

11 

when  we  -- 

12 

BY  MR.  ABDO: 

13 

Q  Is  that  the  --  well,  let  me  ask  by 

14 

example.  Would  that  term,  "large,  strategically 

15 

interconnected  computer  networks,"  include  the 

16 

networks  of  major  Internet  service  providers 

17 

inside  the  United  States? 

18 

MR.  PATTON:  Objection  to  the  extent 

19 

it  calls  for  expert  testimony.  You  can  answer. 

20 

THE  WITNESS:  To  the  extent  that  that 

21 

might  be  one  example  of  what  would  be  included  in 

22 

the  Internet  backbone,  yes,  that's  an  example. 
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1 

BY  MR.  ABDO: 

Page  67 

2 

Q 

I'm  not  sure  I  understood  the  first 

3 

part  of  your  response.  Is  it  or  is  it  not  -- 

4 

sorry,  let 

me  start  that  over. 

5 

Would  or  would  not  a  network  of  a 

6 

major  Internet  service  provider  constitute  a 

7 

large,  strategically  interconnected  computer 

8 

network  as 

the  NSA  has  used  that  term? 

9 

MR.  PATTON:  Object  to  the  form  to  the 

10 

extent  it 

calls  for  expert  testimony. 

11 

You  can  answer. 

12 

THE  WITNESS:  Let  me  clarify  what  I 

13 

think  you' 

re  asking  to  make  sure  I  understand. 

14 

You're  saying  would  a  large  -- 

15 

I ' m  sorry. 

a  communications  provider  in  the 

16 

United  States  be  considered  a  strategically 

17 

interconnected  computer  network? 

18 

BY  MR.  ABDO: 

19 

Q 

Yes . 

20 

A 

Yes . 

21 

Q 

Okay.  Approximately  how  many  data 

22 

transmission  lines  are  there  that  satisfy  the 
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1 

definition  of  "Internet  backbone"  given  by  the 

Page  68 

2 

NSA? 

3 

MR.  PATTON:  Object  to  the  form  to  the 

4 

extent  it  calls  for  expert  testimony. 

5 

You  can  answer. 

6 

THE  WITNESS:  If  you  go  back  and  look 

7 

at  --  I  believe  it's  the  request  for  admission. 

8 

BY  MR.  ABDO: 

9 

Q  You're  welcome  to  refresh  your 

10 

recollection  using  that  document,  but  I'd  like 

11 

your  answer  to  that  question. 

12 

A  Okay,  so  could  you  ask  your  question 

13 

one  more  time? 

14 

Q  Sure.  Approximately  how  many  data 

15 

transmission  lines  are  there  that  satisfy  the 

16 

definition  of  "Internet  backbone"  given  by  the 

17 

NSA? 

18 

MR.  PATTON:  Objection  to  the  extent 

19 

it  calls  for  expert  testimony. 

20 

THE  WITNESS:  How  many  data 

21 

transmission  lines  meet  the  definition  -- 

22 

I ' m  sorry? 
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1 

BY  MR.  ABDO: 

Page  69 

2 

Q  Yeah,  sorry,  let  me  say  it  one  more 

3 

time.  Approximately  how  many  data  transmission 

4 

lines  are  there  that  satisfy  the  definition  of 

5 

"Internet  backbone"  given  by  the  NSA? 

6 

MR.  PATTON:  Just  object,  first  again 

7 

to  the  extent  it  calls  for  expert  testimony,  and 

8 

second,  to  the  extent  it  is  beyond  the  30  (b)  (6) 

9 

deposition  notice. 

10 

Just  to  be  clear,  to  the  extent  it's 

11 

beyond  the  deposition  notice,  she'll  be  answering 

12 

in  her  personal  capacity  as  opposed  to  her 

13 

capacity  as  a  30(b) (6)  NSA  designee. 

14 

I'll  shorten  that  next  time. 

15 

MR.  ABDO:  Just  for  the  record,  would 

16 

you  let  us  know  what  you're  looking  at? 

17 

THE  WITNESS:  I  am  looking  at  the 

18 

Request  for  Admission  response  --  Request  for 

19 

Admission  No.  1  and  No.  2,  just  to  try  and  make 

20 

sure  I'm  --  I  don't  think  that  this  --  how  many 

21 

data  transmission  lines  are  there  that  satisfy  the 

22 

definition . 
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1 

MR.  PATTON: 

The  definition  is 

Page  70 

2 

Interrogatory  Response  12;  is  that  right? 

3 

THE  WITNESS: 

Correct . 

4 

BY  MR.  ABDO: 

5 

Q 

If  you  don't 

know  the  answer,  you 

6 

don  '  t 

know  the  answer. 

I'm  asking  whether  you 

7 

know 

the 

answer . 

8 

A 

I  don ' t  know 

the  answer.  I'm  sorry. 

9 

Q 

Is  there  anyone  at  the  NSA  who  would 

10 

know 

the 

answer  to  that 

question? 

11 

A 

So  to  the  extent  that  the  answer  to 

12 

that 

question  is  available  to  the  public  --  so  I 

13 

guess 

to 

the  extent  that 

that  information  may  be 

14 

available 

in  the  public. 

we  didn't  --  I  don't 

15 

know. 

I  mean,  actually. 

16 

Q 

Do  you  know 

whether  anyone  at  the  NSA 

17 

would 

know  the  answer  to 

that  question  even  if 

18 

based 

on 

information  not 

available  to  the  public? 

19 

MR.  PATTON: 

Well,  object. 

20 

THE  WITNESS: 

So  I  think  -- 

21 

MR.  PATTON: 

Object  to  the  form  to  the 

22 

extent  it 

calls  for  classified  and  otherwise 
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1 

protected  information. 

Page  71 

2 

The  witness  can  answer  the  question  if 

3 

she's  confident  that  the  answer  is  unclassified. 

4 

I ' m  not .  I  am  not . 

5 

THE  WITNESS:  The  answer  to  your 

6 

question,  to  the  extent  it's  unclassified,  and  to 

7 

the  extent  it  is  known,  would  be  in  the  public 

8 

sphere  and  not  something  specific  to  NSA's  --  to 

9 

how  NSA  functions  or  what  NSA  does. 

10 

BY  MR.  ABDO: 

11 

Q  Just  so  I  understand  it,  is  your 

12 

response  then  that  there's  a  further  answer  you 

13 

could  give,  but  will  refuse  to  on  the  basis  of  its 

14 

classification? 

15 

In  other  words,  is  there  more  you 

16 

would  say  but  for  your  belief  that  answering  my 

17 

question  would  disclose  classified  information  or 

18 

protected  information? 

19 

MR.  PATTON:  Objection.  The  answer  I 

20 

believe  calls  for  classified  information  and 

21 

information  otherwise  protected  by  the  statutory 

22 

privileges,  and  I  instruct  the  witness  not  to 
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Page  72 

1 

answer . 

2 

BY  MR.  ABDO: 

3 

Q 

Are  you  going  to  follow  your  -- 

4 

A 

I  am  going  to  follow  my  lawyer's  -- 

5 

Q 

--  instruction  not  to  answer? 

6 

A 

--  instruction  not  to  answer. 

7 

Q 

Is  your  understanding  then  that  even 

8 

answering 

my  question  of  whether  providing  an 

9 

answer  to 

my  question  would  disclose  classified 

10 

information  is  itself  classified? 

11 

MR.  PATTON:  Same  objection. 

12 

Just  a  second. 

13 

(Counsel  conferring.) 

14 

THE  WITNESS:  I  think  it  would  — 

15 

MR.  PATTON:  Just  a  second. 

16 

MR.  PADGETT:  Could  you  read  back  the 

17 

question? 

18 

THE  WITNESS:  I  just  wanted  to  read 

19 

back  the 

question,  yeah,  or  you  can  restate  the 

20 

question . 

21 

BY  MR.  ABDO: 

22 

Q 

Let  me  restate  the  question.  I'll  go 
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1 

back  to  what  I  think  started  us  down  this  path. 

Page  73 

2 

I  originally  asked  whether  there's 

3 

somebody  at  the  NSA  who  knows  how  many  data 

4 

transmission  lines  there  are  that  satisfy  the 

5 

definition  of  "Internet  backbone"  provided  by  the 

6 

NSA.  I  believe  you  said  you  don't  know  the 

7 

answer,  so  I  asked  whether  somebody  at  the  NSA 

8 

would  know  the  answer  to  that  question. 

9 

Then  I  believe  you  said,  please 

10 

correct  me  if  I'm  wrong,  that  to  the  extent 

11 

there's  an  answer  that  you  can  provide  publicly  to 

12 

that  question,  it  was  provided  in  the  NSA's 

13 

responses  to  our  requests  for  admission. 

14 

A  Can  we  go  out  on  a  classified  --  could 

15 

we  take  a  -- 

16 

Q  Sure . 

17 

MR.  PATTON:  Yes.  I  just  want  to  say 

18 

before  we  go  off  the  record  that  object  to  the 

19 

extent  it  misstates  the  prior  testimony,  and  that 

20 

she  also  said  that  it  doesn't  mean  anything 

21 

different  in  an  unclassified  sense  than  what 

22 

telecommunications  experts  would  say. 
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1 

BY  MR.  ABDO: 

Page  74 

2 

Q  Okay.  You  understand  that  I  was 

3 

asking  about  knowledge  that  the  NSA  has 

4 

irrespective  of  whether  that  information  is 

5 

available  to  the  general  public. 

6 

A  I  did  understand.  What  I  said  was  I 

7 

was  not  answering  about  what  NSA  knew  or  didn't 

8 

know  because  there's  a  classification  issue,  but 

9 

to  the  extent  there  was  an  answer  to  your 

10 

question,  it  would  be  whatever  you  could  find  in 

11 

the  public. 

12 

And  so  similar  to  what  you  see  in 

13 

response  to  RFA  1,  where  we  give  the  information 

14 

that  TeleGeography  publishes,  to  the  extent  they 

15 

have  information  that  would  say  --  provide  the 

16 

answer  to  this  question,  but  I  don't  think  that 

17 

the  answer  to  RFA  1  was  the  same  as  what  you  were 

18 

asking . 

19 

MR.  PATTON:  And  so  we'll  go  off  the 

20 

record  and  see  if  there's  more  information  that 

21 

can  be  provided  unclassified. 

22 

MR.  ABDO:  That's  fine,  although  I'm 
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also  trying  to  establish  whether  there's  somebody 

Page  75 

2 

at  the  NSA  who  would  be  able  to  provide  a 

3 

classified  response,  even  if  not  here  today. 

4 

whether  there's  somebody  who  could  provide  that 

5 

response  if  we  were  to  move  to  compel  that 

6 

response . 

7 

It  sounds  as  though  you're  not  that 

8 

person  from  what  you're  saying.  I'm  trying  to 

9 

understand  if  there's  somebody  else  who  is  that 

10 

person . 

11 

THE  WITNESS:  And  so  could  we 

12 

please  -- 

13 

MR.  PATTON:  Wait  a  second. 

14 

And  we're  trying  to  figure  out  whether 

15 

we  can  tell  you  that. 

16 

THE  WITNESS:  Yes,  so  let  us  go  have 

17 

that  -- 

18 

MR.  ABDO:  We'll  go  off  the  record  for 

19 

a  few  minutes . 

20 

(Off  the  record  at  10:38  a.m.) 

21 

(Resume  at  10:47  a.m.) 

22 

MR.  PATTON:  Have  we  got  a  question 
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pending? 

Page  76 

2 

MR.  ABDO:  Yes,  we  have  a  question 

3 

pending,  and  as  I  understand  it,  Ms.  Richards,  you 

4 

went  out  to  consult  with  counsel  about  whether  you 

5 

could  respond  to  my  question  without  disclosing 

6 

classified  information. 

7 

Have  you  arrived  at  a  conclusion? 

8 

MR.  PATTON:  Yes.  It's  like  a  jury. 

9 

we  have  arrived  at  a  verdict. 

10 

So  just  to  put  my  objections  on  the 

11 

record,  one  is  that  it  calls  for  expert  testimony; 

12 

two,  it  is  beyond  the  30(b)  (6)  notice,  and 

13 

therefore  the  witness's  answer,  if  she  were  to 

14 

give  one,  would  be  in  her  personal  capacity  as 

15 

opposed  to  her  capacity  as  a  30(b) (6)  witness. 

16 

And  if  I  understand  the  question 

17 

correctly,  anything  beyond  the  unclassified 

18 

information  that's  already  been  provided  in  the 

19 

RFA,  we  can  neither  confirm  nor  deny  whether  or 

20 

not  -- 

21 

MR.  PADGETT:  I'm  sorry. 

22 

(Counsel  conferring.) 
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1 

MR.  PATTON:  So  striking  the  last 

Page  77 

2 

part,  whether  NSA  has  any  nonpublic  information 

3 

going  beyond  what's  already  in  the  RFA  we  can 

4 

neither  confirm  nor  deny,  so  on  that  basis. 

5 

instruct  the  witness  not  to  answer  the  pending 

6 

question . 

7 

BY  MR.  ABDO: 

8 

Q  And  you'll  follow  your  lawyer's 

9 

instruction  not  to  answer? 

10 

A  I  will  follow  my  lawyer's  advice  not 

11 

to  answer. 

12 

Q  Okay.  Could  you  please  turn  to  page  5 

13 

of  Exhibit  42  --  sorry,  page  6  of  Exhibit  42.  You 

14 

were  here  a  moment  ago,  but  if  you  need  to,  would 

15 

you  please  re-read  the  two  paragraphs  designated 

16 

as  "RESPONSE"  on  that  page. 

17 

A  I'm  sorry,  to  clarify,  we're  on  the 

18 

interrogatories  ? 

19 

Q  Yes.  Exhibit  42  are  the  NSA's 

20 

Responses  and  Objections  to  Plaintiff's  First  Set 

21 

of  Interrogatories,  page  6. 

22 

A  Page  6,  yes. 
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1 

Q  If  you  need  to,  just  refresh  your 

Page  78 

2 

memory  of  that  response. 

3 

A  Yes . 

4 

Q  Is  an  international  submarine  cable 

5 

that  connects  two  stations  a  circuit  as  the  NSA 

6 

has  defined  that  term  in  response  to  Interrogatory 

7 

No.  2? 

8 

MR.  PATTON:  Objection  to  the  extent 

9 

it  calls  for  expert  testimony. 

10 

THE  WITNESS:  As  with  Internet 

11 

backbone,  "circuit"  has  no  specific  NSA  meaning. 

12 

It  is  the  meaning  that  a  telecommunications  expert 

13 

would  expect  it  to  mean.  There's  nothing 

14 

something  special.  So  I  just  want  to  make  sure 

15 

that  that's  clear,  there's  not  some  other 

16 

definition  out  there. 

17 

To  the  extent  that  you  asked  whether 

18 

two  submarine  cables  would  be  --  I'm  sorry,  I  just 

19 

want  to  make  sure . 

20 

BY  MR.  ABDO: 

21 

Q  Whether  an  international  submarine 

22 

cable  that  connects  two  stations  is  a  circuit. 
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1 

A 

Yeah . 

Page  79 

2 

MR.  PATTON:  Same  objection. 

3 

THE  WITNESS:  Yes. 

4 

BY  MR.  ABDO: 

5 

Q 

Okay.  Is  an  international  submarine 

6 

cable 

that  connects  two  stations  a  circuit  on  the 

7 

Internet 

backbone? 

8 

MR.  PATTON:  Object  to  the  form. 

9 

vague . 

Objection  to  the  extent  it  calls  for 

10 

expert 

testimony . 

11 

THE  WITNESS:  Say  it  one  more  time. 

12 

BY  MR.  ABDO: 

13 

Q 

Do  you  want  me  to  repeat  that? 

14 

A 

Yes,  please. 

15 

Q 

Sure.  Is  an  international  submarine 

16 

cable 

that  connects  two  stations  a  circuit  on  the 

17 

Internet 

backbone? 

18 

MR.  PATTON:  Objection  to  the  extent 

19 

it  calls 

for  expert  testimony. 

20 

THE  WITNESS:  Yes. 

21 

BY  MR.  ABDO: 

22 

Q 

Okay.  Is  each  optical  fiber  within  an 
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1 

international  submarine  cable  that  connects  two 

Page  80 

2 

stations  a  circuit? 

3 

MR.  PATTON:  Objection.  Same 

4 

objection  as  before. 

5 

THE  WITNESS:  Each  of  these  is  an 

6 

example  of  what  might  be  a  circuit  and  what  might 

7 

be  considered  the  Internet  backbone. 

8 

So  to  the  extent  an  optical  fiber  is 

9 

given  as  an  example  of  a  circuit,  then  the  answer 

10 

would  be  yes,  but  they're  an  example. 

11 

BY  MR.  ABDO: 

12 

Q  That's  right.  I'm  not  asking  --  let 

13 

me  try  to  be  clear. 

14 

A  Okay. 

15 

Q  Each  of  these  questions  is  asking 

16 

whether  a  particular  data  transmission  line 

17 

connecting  two  stations  constitutes  a  circuit. 

18 

I'm  not  asking  for  you  to  confirm  that  that's  the 

19 

only  sort  of  circuit  out  there. 

20 

A  Okay. 

21 

Q  So  I  am  asking  whether  these  are 

22 

examples  of  a  circuit,  not  whether  they  are  the 
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sum  total  of  what  might  be  a  circuit. 

Page  81 

2 

A  Okay. 

3 

Q  With  that  understanding,  is  your 

4 

answer  to  my  last  question  --  what  is  your  answer 

5 

to  my  last  question,  which  was  is  each  optical 

6 

fiber  within  an  international  submarine  cable  that 

7 

connect  two  stations  a  circuit? 

8 

MR.  PATTON:  Objection  to  the  extent 

9 

it  mischaracterizes  the  prior  testimony. 

10 

Objection,  calls  for  expert  testimony. 

11 

THE  WITNESS:  Circuit  could  —  the 

12 

definition  of  "circuit"  being  two  stations. 

13 

instruments  transmitting  information,  could  be  an 

14 

example  of  --  could  be  an  example.  So  it  could 

15 

be,  yes. 

16 

BY  MR.  ABDO: 

17 

Q  When  you  say  it  could  be,  you're 

18 

referring  again  to  an  optical  fiber  within  an 

19 

international  submarine  cable? 

20 

A  Yes,  it  could  be. 

21 

Q  If  an  optical  fiber  within  an 

22 

international  submarine  cable  has  been 
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1 

multiplexed,  would  each  of  the  subdivisions 

Page  82 

2 

created  by  that  multiplexing  be  a  circuit? 

3 

MR.  PATTON:  Objection  to  the  extent 

4 

it  calls  for  expert  testimony.  You  can  answer. 

5 

THE  WITNESS:  It  could  be. 

6 

BY  MR.  ABDO: 

7 

Q  In  what  circumstance  would  it  be,  and 

8 

in  what  circumstance  would  it  not  be? 

9 

A  I'm  trying  to  think  if  there's  an 

10 

example  where  it  wouldn't  be.  I  think  the 

11 

definition  -- 

12 

MR.  PATTON:  Same  objection  to  that 

13 

question  and  this  line  of  questioning. 

14 

THE  WITNESS:  Yeah.  So  a 

15 

telecommunications  expert  would  undoubtedly 

16 

consider  it  to  be  a  circuit. 

17 

BY  MR.  ABDO: 

18 

Q  Would  the  NSA  also  consider  it  to  be  a 

19 

circuit? 

20 

A  To  the  extent  that  there's  no  -- 

21 

MR.  PATTON:  Object.  Objection  to  the 

22 

form  to  the  extent  it  calls  for  expert  testimony. 
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1 

THE  WITNESS:  To  the  extent  that 

Page  83 

2 

there's  no  difference  in  the  definition  that  NSA 

3 

takes  versus  what  a  telecommunications  expert 

4 

takes,  there's  no  special  meaning  to  the  word 

5 

"circuit."  So  if  they  would  consider  it  to  be  a 

6 

circuit,  then  NSA  would  consider  it  to  be  a 

7 

circuit . 

8 

BY  MR.  ABDO: 

9 

Q  Okay.  Can  a  single  circuit  span 

10 

multiple  physical  paths  between  two  stations? 

11 

MR.  PATTON:  Objection,  vague. 

12 

Objection,  calls  for  expert  testimony. 

13 

THE  WITNESS:  Can  a  single  — 

14 

BY  MR.  ABDO: 

15 

Q  Can  a  single  circuit  span  multiple 

16 

physical  paths  between  two  stations? 

17 

And  I  understand  you'll  make  the  same 

18 

ob j  ections . 

19 

MR.  PATTON:  Same  objections.  And  I 

20 

would  just  add  beyond  the  scope  of  30(b) (6),  and 

21 

therefore  the  witness  will  be  testifying  in  her 

22 

personal  capacity  as  opposed  to  her  30  (b)  (6) 
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1 

designee  capacity. 

Page  84 

2 

MR.  ABDO:  Rodney,  if  it's  okay  with 

3 

you,  can  we  shorten  that  objection  to  it's  beyond 

4 

the  scope? 

5 

MR.  PATTON:  As  long  as  you  understand 

6 

that  what  that  means  here  is  that  she's  testifying 

7 

as  Becky  Richards  and  not  testifying  as  a  30(b)  (6) 

8 

witness  for  the  NSA. 

9 

MR.  ABDO:  Thanks.  I  will  so 

10 

understand  it. 

11 

THE  WITNESS:  And  I  will  — 

12 

BY  MR.  ABDO: 

13 

Q  Let  me  restate  the  question. 

14 

A  I've  now  lost  what  the  question  is  as 

15 

Becky  answering. 

16 

Q  Let  me  restate  it,  okay? 

17 

Can  a  single  circuit  span  multiple 

18 

physical  paths  between  two  stations? 

19 

MR.  PATTON:  Objection,  calls  for 

20 

expert  testimony.  Objection,  beyond  the  scope  of 

21 

30 (b)  (6)  . 

22 

THE  WITNESS:  I'm  going  to  answer  I 

TransPerfect  Legal  Solutions 
212-400-8845  -  Depo@TransPerfect.com 


OlgiaeaiI555xz^jQO06B2FEEE  DBoPoreBtilSSStS  FffflddLQMafl^aS  PBggdL80  of  4098 


1 

don't  know. 

Page  85 

2 

BY  MR.  ABDO: 

3 

Q  Do  you  know  whether  there's  anybody 

4 

else  at  the  NSA  who  would  know  the  answer  to  that 

5 

question? 

6 

MR.  PATTON:  You  can  answer  if  you 

7 

have  an  unclassified  -- 

8 

THE  WITNESS:  I  don't  know. 

9 

BY  MR.  ABDO: 

10 

Q  You  don't  know  whether  there's 

11 

somebody  else  at  the  NSA  who  would  know  the  answer 

12 

to  that  question? 

13 

A  Correct. 

14 

Q  Did  you  talk  to  any  subject  matter 

15 

experts  at  the  NSA  about  the  meaning  of  the  term 

16 

"circuit"  prior  to  this  deposition? 

17 

A  I  did. 

18 

Q  As  part  of  that  conversation,  did  you 

19 

do  anything  beyond  reviewing  the  definition  of 

20 

"circuit"  provided  by  the  NSA  in  response  to  our 

21 

Interrogatory  No.  2? 

22 

MR.  PATTON:  Objection,  vague. 
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1 

THE  WITNESS:  We  discussed  generally 

Page  86 

2 

what  is  meant  by  "circuit"  in  the  context  of  a 

3 

telecommunications  expert. 

4 

We  did  not  get  to  the  specific 

5 

whatever  you  just  asked  of  a  single  circuit  having 

6 

multiple  physical  paths. 

7 

BY  MR.  ABDO: 

8 

Q  Okay.  What's  your  understanding  of 

9 

the  term  "virtual  circuit"? 

10 

MR.  PATTON:  Object  to  the  form,  calls 

11 

for  expert  testimony,  and  beyond  the  scope  of 

12 

30 (b)  (6)  . 

13 

THE  WITNESS:  As  described  in  the  -- 

14 

are  we  still  on  the  interrogatories  on  page  6  in 

15 

response  to  No.  2? 

16 

BY  MR.  ABDO: 

17 

Q  Yes.  Let  me  try  to  be  clear. 

18 

What  is  your  understanding  of  the  term 

19 

"virtual  circuit"  as  used  by  the  NSA  in  its 

20 

response  to  Interrogatory  No.  2? 

21 

A  My  understanding  is  that  there's  a  way 

22 

in  which  to  use  different  techniques  to  divide  the 
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circuits  so  that  you  have  more  than  one  -- 

Page  87 

2 

multiple  circuits  on  one  circuit. 

3 

Q  Let  me  just  try  to  understand  that. 

4 

Do  virtual  circuits  --  let  me  start 

5 

over.  Can  a  virtual  circuit  traverse  multiple 

6 

physical  circuits? 

7 

MR.  PATTON:  Objection  to  the  extent 

8 

it  calls  for  expert  testimony,  and  beyond  the 

9 

scope  of  30 (b) (6) . 

10 

THE  WITNESS:  I'll  respond  I  don't 

11 

know . 

12 

BY  MR.  ABDO: 

13 

Q  Is  there  anyone  at  the  NSA  who  would 

14 

know  the  answer  to  that  question? 

15 

A  I  don't  know. 

16 

Q  Did  you  talk  with  any  subject  matter 

17 

experts  at  the  NSA  about  the  definition  of  or  the 

18 

meaning  of  the  term  "virtual  circuit"  as  used  in 

19 

the  NSA's  response  to  Interrogatory  No.  2? 

20 

A  I  did. 

21 

Q  Is  there  anything  about  the  meaning  of 

22 

the  term  "virtual  circuit"  that  you  can  provide 
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1 

beyond  what  is  in  the  NSA's  response  to 

Page  88 

2 

Interrogatory  No.  2? 

3 

A  Since  I'm  not  the  telecommunications 

4 

subject  matter  expert,  my  answer  is  confined  to 

5 

what  you  see  on  the  piece  of  paper. 

6 

Q  Is  there  a  telecommunications  subject 

7 

matter  expert  at  the  NSA  who  could  more  fully 

8 

answer  that  question? 

9 

Let  me  restate  the  question. 

10 

Is  there  anyone  at  the  NSA  who  could 

11 

more  fully  define  what  the  term  "virtual  circuit" 

12 

means  as  used  by  the  NSA  in  response  to 

13 

Interrogatory  No.  2? 

14 

MR.  PATTON:  To  the  extent  that  the 

15 

answer  is  yes  or  no,  she  can  answer,  but  I'll  note 

16 

for  the  record  that  she's  testified  multiple  times 

17 

that  the  NSA  does  not  mean  anything  different  by 

18 

the  term  "virtual  circuit"  other  than  what  is 

19 

understood  within  the  telecommunications  industry. 

20 

BY  MR.  ABDO: 

21 

Q  What  is  the  meaning  of  "virtual 

22 

circuit"  as  understood  within  the 
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telecommunications  industry? 

Page  89 

2 

MR.  PATTON:  I'm  going  to  object  to 

3 

the  question  to  the  extent  it  calls  for  expert 

4 

testimony. 

and  beyond  the  scope  of  30(b)  (6)  . 

5 

BY  MR.  ABDO: 

6 

Q 

You  can  answer. 

7 

A 

I  don't  have  anything  further  to 

8 

define  for 

you . 

9 

Q 

Is  there  anyone  at  the  NSA  who  better 

10 

understands 

the  definition  of  "virtual  circuit"  as 

11 

used  by  those  in  the  telecommunications  industry? 

12 

MR.  PATTON:  You  can  answer  the 

13 

question  if 

it's  unclassified. 

14 

THE  WITNESS:  I  don't  know. 

15 

MR.  PATTON:  You  can't  provide  a  name. 

16 

THE  WITNESS:  I  don't  know. 

17 

BY  MR.  ABDO: 

18 

Q 

You  don't  know  whether  there's  anyone 

19 

at  the  NSA? 

20 

A 

Correct . 

21 

Q 

It's  true  --  well,  let  me  ask  you. 

22 

Is  it  true  that  each  Internet  protocol 
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1 

packet  sent  on  the  Internet  is  routed  to  its 

Page  90 

2 

destination  independently? 

3 

MR.  PATTON:  Object  to  the  form  of  the 

4 

question  to  the  extent  it  calls  for  expert 

5 

testimony,  and  outside  the  scope  of  30 (b) (6) . 

6 

You  can  answer. 

7 

THE  WITNESS:  I'm  sorry,  can  you  ask 

8 

the  question  again? 

9 

BY  MR.  ABDO: 

10 

Q  Sure.  Is  it  true  that  each  Internet 

11 

protocol  packet  sent  on  the  Internet  is  routed  to 

12 

its  destination  independently? 

13 

MR.  PATTON:  Same  objections. 

14 

THE  WITNESS:  Generally  speaking,  yes. 

15 

that  is  my  understanding. 

16 

BY  MR.  ABDO: 

17 

Q  Are  there  circumstances  you  can  think 

18 

of  where  Internet  protocol  packets  would  not  be 

19 

routed  independently  on  the  Internet? 

20 

MR.  PATTON:  Object  to  the  form  to  the 

21 

extent  it  calls  for  expert  testimony,  and  beyond 

22 

the  scope  of  30(b) (6) .  You  can  answer. 
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1 

THE  WITNESS:  Not  off  the  top  of  my 

Page  91 

2 

head,  but  I'm  sure  there  are  examples. 

3 

BY  MR.  ABDO: 

4 

Q  Why  are  you  sure  there  are  examples? 

5 

A  Just  because  every  rule  seems  to  have 

6 

some  sort  of  exception  to  it,  so  to  say  something 

7 

is  hard  and  fast  to  be  always  the  case  is  not 

8 

something  I  would  like  to  do. 

9 

Q  Okay.  When  Internet  packets  that 

10 

constitute  a  single  communication  take  different 

11 

paths  to  a  common  destination,  are  those  packets 

12 

traversing  different  circuits  or  the  same  circuit? 

13 

MR.  PATTON:  Object  to  the  form,  lacks 

14 

foundation,  object  to  the  vagueness  of  the  term 

15 

"single  communication."  Object  that  it  calls  for 

16 

expert  testimony,  and  it  is  beyond  the  scope  of 

17 

30(b) (6) .  You  can  answer. 

18 

THE  WITNESS:  The  question  was  if 

19 

packets  take  a  different  path,  are  they  on 

20 

different  circuits? 

21 

BY  MR.  ABDO: 

22 

Q  Yes . 
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A  I  would  say  it  depends.  There's  not. 

Page  92 

2 

again,  a  hard  and  fast  rule.  Depending,  it  might 

3 

be  on  the  same  circuit,  it  might  be  on  a  different 

4 

circuit . 

5 

Q  What  does  it  depend  on? 

6 

MR.  PATTON:  Same  set  of  objections. 

7 

THE  WITNESS:  I  guess  it  would  depend 

8 

on  how  --  what  would  it  depend  on? 

9 

It  would  depend  on  the  nature  of  the 

10 

circuit . 

11 

BY  MR.  ABDO: 

12 

Q  What  do  you  mean  by  the  nature  of  the 

13 

circuit? 

14 

MR.  PATTON:  Same  objections. 

15 

THE  WITNESS:  Depending  on  how  the 

16 

packets  were  going  and  how  you  --  how  is  it 

17 

routed?  Do  they  take  different  paths,  or  are  they 

18 

on  the  same  circuit? 

19 

So  to  the  extent  the  circuit  can  be 

20 

meant  in  a  big  sense  or  in  a  small  sense,  it's 

21 

going  to  decide  whether  it's  on  the  same  circuit 

22 

or  not. 
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1 

So  you  asked  in  a  separate  set  of 

Page  93 

2 

line,  had  a  whole  bunch  of  distinctions  as  to  what 

3 

was  data  transmission  line  and  what  were  they,  and 

4 

was  it  a  wavelength,  or  something  further  into 

5 

that.  So  it  will  depend  on  how  you  define 

6 

"circuit,"  which  is  why  you  were  asking  me  to 

7 

define  "circuit." 

8 

BY  MR.  ABDO: 

9 

Q  Let  me  just  try  to  understand. 

10 

Does  the  answer  to  my  question  depend 

11 

on  whether  the  separate  paths  being  taken  by 

12 

packets  are  being  routed  over  one  physical  circuit 

13 

or  not? 

14 

MR.  PATTON:  Same  set  of  objections. 

15 

THE  WITNESS:  One  physical  circuit? 

16 

BY  MR.  ABDO: 

17 

Q  Suppose  two  packets  that  are  part  of 

18 

the  same  communication  traverse  different  optical 

19 

fibers . 

20 

A  Okay.  Are  those  different  circuits? 

21 

Q  Yes,  that's  my  question. 

22 

MR.  PATTON:  Object  to  the  extent  it 
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1 

calls  for  expert  testimony  in  a  hypothetical,  and 

Page  94 

2 

also  beyond  the  scope  of  30(b)  (6)  . 

3 

THE  WITNESS:  So  — 

4 

MR.  PATTON:  Also  asked  and  answered. 

5 

THE  WITNESS:  So  if  it's  on  two 

6 

different  circuits,  then  it's  on  two  different 

7 

circuits.  I  feel  like  I'm  having  a  circular 

8 

conversation,  so  I'm  not  sure.  Can  two  packets  be 

9 

on  the  same  circuit  and  take  different  paths? 

10 

MR.  PATTON:  I  don't  think  that's  the 

11 

question . 

12 

THE  WITNESS:  Is  that  — 

13 

BY  MR.  ABDO: 

14 

Q  My  original  question  was  whether 

15 

packets  that  are  traversing  different  paths  to 

16 

their  common  destination  are  traversing  different 

17 

circuits.  And  I  believe,  please  correct  me  if  I'm 

18 

wrong,  you  said,  generally,  yes. 

19 

MR.  PATTON:  That's  a  misstatement  of 

20 

her  prior  testimony. 

21 

BY  MR.  ABDO: 

22 

Q  Could  you  please  tell  us  what  your 
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answer  is  to  that  original  question? 

Page  95 

2 

MR.  PATTON:  Do  you  want  the  question 

3 

to  be  read  back? 

4 

MR.  ABDO:  No.  I  mean,  let's  move  on. 

5 

Would  you  mind,  Ms.  Jaques,  marking 

6 

this  as  Exhibit  43? 

7 

(Deposition  Exhibit  43  was 

8 

marked  for  identification.) 

9 

BY  MR.  ABDO: 

10 

Q  So  you  have  in  front  of  you  what's 

11 

been  marked  as  Exhibit  43. 

12 

Do  you  recognize  that  document? 

13 

A  Absolutely. 

14 

Q  And  what  is  Exhibit  43? 

15 

A  Privacy  and  Civil  Liberties  Oversight 

16 

Board,  Report  on  the  Surveillance  Program  Operated 

17 

Pursuant  to  Section  702  of  the  Eoreign 

18 

Intelligence  Surveillance  Act,  July  2nd,  2014. 

19 

Q  What  was  the  NSA's  relationship  to  the 

20 

drafting  or  review  of  the  report  marked 

21 

Exhibit  43? 

22 

MR.  PATTON:  Objection  as  vague,  and 
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1 

objection  to  the  extent  it  may  call  for 

Page  96 

2 

deliberative  process  privilege  that  might  be 

3 

invoked  by  the  PCLOB  that  we  don't  represent.  So 

4 

maybe  if  you  could  ask  a  more  narrow  question,  we 

5 

can  avoid  most  of  the  deliberative  process. 

6 

She  can  speak  in  general  terms  on 

7 

that,  that  would  be  good,  in  answer  to  your 

8 

question,  but  I  don't  want  to  too  broadly  object 

9 

on  deliberative  process  grounds  to  protect  PCLOB ' s 

10 

privilege . 

11 

BY  MR.  ABDO: 

12 

Q  Let  me  ask  a  different  related 

13 

question.  Was  the  NSA  involved  in  the  drafting  of 

14 

Exhibit  43? 

15 

MR.  PATTON:  Objection,  vague. 

16 

THE  WITNESS:  NSA  provided  expert 

17 

testimony  to  the  Board  as  is  described  on  page  4 

18 

of  the  report.  We  provided  documentation,  we 

19 

provided  presentations,  and  we  answered  questions 

20 

throughout  their  process. 

21 

We  then  for  the  fact  section 

22 

reviewed  --  we  reviewed  the  document  for  factual 
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accuracy,  as  well  as  we  reviewed  the  entire 

Page  97 

2 

document  for  classification  to  ensure  there  was  no 

3 

classified  material  in  it. 

4 

BY  MR.  ABDO: 

5 

Q  So  I  believe  that  you  said  that  the 

6 

NSA  provided  testimony,  documentation,  and 

7 

presentations  to  the  members  of  the  PCLOB  in 

8 

drafting  Exhibit  43,  right? 

9 

A  That  is  correct. 

10 

Q  Do  you  know  how  many  sessions  the  NSA 

11 

provided  testimony  about  the  subject  matter  of  the 

12 

report  that's  marked  Exhibit  43? 

13 

A  It  was  a  handful.  I  don't  remember 

14 

the  exact  number,  but  certainly  they  came  to  NSA, 

15 

and  we  went  to  the  PCLOB  a  number  of  times,  both 

16 

ways.  We  had  conference  calls,  and  we  had  email 

17 

exchanges . 

18 

Q  And  did  that  testimony  involve  both 

19 

classified  and  unclassified  information? 

20 

A  Yes,  it  did. 

21 

Q  Is  the  same  true  of  the  documentation 

22 

that  the  NSA  provided  to  the  PCLOB? 
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A 

Yes,  it  was  both  classified 

and 

Page  98 

2 

unclassified . 

3 

Q 

And  is  that  also  true  of  the 

4 

presentations  provided? 

5 

A 

Yes,  all  was  classified  and 

6 

unclassified . 

7 

Q 

And  you  say  that  the  NSA  reviewed  the 

8 

factual  section  of  the  report  marked  Exhibit  43 

9 

for  accuracy;  is  that  correct? 

10 

A 

That  is  correct. 

11 

Q 

When  you  say  "fact  section," 

what 

12 

specific  pages  are  you  referring  to,  or 

page  range 

13 

are  you  referring  to? 

14 

A 

Page  16  to  79.  In  essence. 

Part  3, 

15 

Description 

and  History. 

16 

Q 

Did  the  NSA  review  any  other 

portion 

17 

of  the  report  marked  Exhibit  43  for  factual 

18 

accuracy? 

19 

MR.  PATTON:  Objection  to  the  form. 

20 

vague  as  to 

time  . 

21 

THE  WITNESS:  NSA  otherwise 

did  a 

22 

classification  review  of  the  document. 
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To  the  extent  these  documents  have  the 
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2 

opinions 

of  the  various  board  members,  NSA 

was  not 

3 

reviewing 

that  information  beyond  ensuring 

there 

4 

was  no  classified  material  in  it. 

5 

BY  MR.  ABDO: 

6 

Q 

If  the  NSA,  during  its  classification 

7 

review  of 

the  portions  of  the  report,  other 

than 

8 

Part  3,  noticed  a  factual  inaccuracy,  would 

the 

9 

NSA  have 

notified  the  PCLOB  of  that  inaccuracy? 

10 

A 

NSA  conducted  a  classification 

review 

11 

of  the  document.  As  part  of  that  classification 

12 

review,  to  the  extent  that  something  would 

be 

13 

described 

in  some  of  the  other  pieces  of  the 

14 

document 

that  was  not  not,  we  would  notify 

them  as 

15 

part  of  that,  as  is  noted  again  on  page  4. 

16 

Q 

Let  me  just  make  sure  I  understand. 

17 

A 

Yeah . 

18 

Q 

The  NSA  reviewed  Part  3  of  the 

report 

19 

marked  Exhibit  43  for  accuracy,  right? 

20 

A 

That  is  correct. 

21 

Q 

It  reviewed  the  entire  document 

for 

22 

classification,  right? 
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A 

Correct . 

Page  100 

2 

Q 

And  if  in  the  process  of  reviewing  the 

3 

entire  document  for  classification  it  noticed  an 

4 

inaccuracy 

outside  the  portion  that  it  reviewed 

5 

solely  for 

accuracy  --  sorry,  outside  the  portion 

6 

that  it  reviewed  when  it  was  conducting  its  review 

7 

for  accuracy,  your  testimony  is  that  the  NSA  would 

8 

have  notified  the  PCLOB  of  that  inaccuracy? 

9 

A 

Correct . 

10 

Q 

Was  the  NSA's  review  for  accuracy  of 

11 

the  factual 

section  of  the  report  thorough? 

12 

MR.  PATTON:  Objection,  vague. 

13 

THE  WITNESS:  Yes. 

14 

BY  MR.  ABDO: 

15 

Q 

The  NSA  would  have  reviewed  every 

16 

sentence? 

17 

A 

Absolutely . 

18 

Q 

And  what  would  the  NSA  have  done  if  it 

19 

noticed  an 

inaccuracy  in  any  portion  of  the 

20 

report? 

21 

MR.  PATTON:  Objection,  vague. 

22 

THE  WITNESS:  NSA  would  provide  a 
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response  explaining  either  why  it  was  inaccurate 
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2 

or  why  the  information  in  the  classification 

3 

review  was  classified,  and  there  was  --  as  is 

4 

important  to  remember  in  the  Upstream,  large 

5 

portions  of  that  program  remain  classified,  and  so 

6 

necessarily  with  this  report,  with  this  NSA  Civil 

7 

Liberties  and  Privacy  Office  Report,  the 

8 

information  is  incomplete. 

9 

And  so  a  lot  of  the  conversation  was  a 

10 

mixture  of  how  do  you  provide  an  accurate 

11 

representation  of  how  Upstream  works  while  keeping 

12 

the  sources  and  methods  classified?  And  so  a  lot 

13 

of  the  conversation,  particularly  around  the 

14 

accuracy  and  the  classification,  were  tied 

15 

together  because  of  those  reasons. 

16 

And  so  this  gives,  as  does  our  report. 

17 

and  continues  to,  a  broad  accurate  description  of 

18 

the  outline  of  how  the  program  runs,  but  does  not 

19 

get  into  some  of  the  much  more  specific  aspects  to 

20 

it . 

21 

BY  MR.  ABDO: 

22 

Q  In  the  course  of  the  review  for 

TransPerfect  Legal  Solutions 
212-400-8845  -  Depo@TransPerfect.com 


(aEEaas]lffi5gwqHBaaSg-1«  DanmmTOittJBB.^  fftItetlISfflaSfflaB 


1 

accuracy  of  the  report,  did  the  NSA  notice 

Page  102 

2 

inaccuracies  and  make  recommendations  to  the  PCLOB 

3 

about  how  to  fix  those  inaccuracies  in  what's  now 

4 

marked  Exhibit  43? 

5 

A  Yes . 

6 

Q  Are  you  aware  --  sorry,  strike  that. 

7 

Did  the  PCLOB  generally  accept  those 

8 

recommendations? 

9 

MR.  PATTON:  Just  a  second. 

10 

(Counsel  conferring.) 

11 

MR.  PATTON:  Could  you  read  the 

12 

question  back? 

13 

(The  reporter  read  back  the  question.) 

14 

MR.  PATTON:  Just  object  to  beyond  the 

15 

scope  of  the  30(b) (6) . 

16 

And  if  the  answer  to  that  question  is 

17 

yes  or  no,  you  can  answer.  If  the  answer  to  that 

18 

question  is  going  to  be  a  narrative  description  of 

19 

what  the  PCLOB  did  or  did  not  accept,  then  we're 

20 

concerned  that  we  might  be  in  the  deliberative 

21 

process . 

22 

MR.  ABDO:  I  just  want  to  state  for 
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the  record,  Rodney,  you  don't  represent  the  PCLOB, 
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2 

correct? 

3 

MR.  PATTON:  I  do  not,  but  I  am  with 

4 

the  Department  of  Justice,  and  we  do  represent  the 

5 

United  States,  so  here  we  would  be  preserving 

6 

their  ability  to  later  assert  that  privilege  if 

7 

need  be.  I  certainly  am  not  in  a  capacity  to 

8 

waive  it  on  their  behalf. 

9 

MR.  ABDO:  I'm  just  not  sure  you're  in 

10 

a  position  to  assert  it  though.  I'm  not  sure 

11 

we're  asking  for  anything  that's  going  to  reveal 

12 

the  deliberations  anyway,  but  I  note  that  we 

13 

object  to  your  quasi-invocation  of  the  PCLOB ' s 

14 

deliberative  process. 

15 

MR.  PATTON:  I  can  rephrase  it  as  a 

16 

preservation  of  their  right  to  assert  the 

17 

deliberative  process  privilege,  since  they  are  not 

18 

here  to  invoke  that  themselves. 

19 

MR.  GILLIGAN:  I  would  add  that  our 

20 

function  as  Department  of  Justice  attorneys  is  to 

21 

represent  the  interests  of  the  United  States  in 

22 

this  proceeding,  and  PCLOB  is  an  independent 
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establishment  of  the  United  States  government,  but 
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2 

I  understand  your  objection. 

3 

MR.  ABDO:  Sure,  but  you  also  know 

4 

that  we  had  --  you  know.  Topic  6  very  clearly 

5 

included  this  report  as  a  subject  of  this 

6 

deposition . 

7 

MR.  PATTON:  I  doubt,  again,  that  you 

8 

will  be  delving  into  the  details  of  that.  There's 

9 

an  awful  lot  -- 

10 

MR.  GILLIGAN:  The  facts,  not 

11 

recommendations . 

12 

MR.  PATTON:  There's  an  awful  lot  of 

13 

questions  that  the  witness  is  perfectly  capable  of 

14 

answering,  so  I  don't  think  we're  going  to  be  in 

15 

any  -- 

16 

BY  MR.  ABDO: 

17 

Q  Ms.  Richards,  can  you  answer  the 

18 

question? 

19 

A  Yes,  I'll  answer  the  question. 

20 

What  I  would  do  is  point  you  to. 

21 

again,  page  4  that  specifically  says  that  they 

22 

considered  the  Intelligence  Community's  comments 
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regarding  the  operation  of  the  program  to  ensure 
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2 

accuracy.  None  of  the  changes  resulting  from  that 

3 

process  affected  the  Board's  substantive  analysis 

4 

and  recommendations. 

5 

So  I  would  point  you  to  that  to  avoid 

6 

this  whole  conversation  about  what  is  or  isn't 

7 

sort  of  privileged  between  it  to  say  that  they 

8 

accepted  our  changes,  they  didn't  change 

9 

substantively  what  they  were  doing.  We  went 

10 

through  a  back-and-f orth  to  ensure  that  everybody 

11 

understood  how  the  program  worked,  what  was 

12 

classified . 

13 

In  some  instances,  they  asked  for 

14 

information  to  be  declassified  in  order  to  make 

15 

the  record  full,  and  that  didn't  change.  So  we 

16 

went  through  that  process. 

17 

Q  Let  me  ask  my  question  again  because  I 

18 

don't  think  that  answered  it. 

19 

A  Sure,  okay. 

20 

Q  If  the  NSA  identified  an  inaccuracy  in 

21 

the  report  marked  as  Exhibit  43  to  the  PCLOB, 

22 

would  the  PCLOB  generally  fix  that  factual 
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inaccuracy,  generally  have  fixed  it? 

Page  106 

2 

MR.  PATTON:  Object  to  the  form. 

3 

vague . 

4 

THE  WITNESS:  Yes.  The  PCLOB  was  not 

5 

interested  in  having  an  inaccurate  description  of 

6 

how  Section  702  --  it  was  not  within  --  they 

7 

didn't  want  to  have  that,  and  so  they  worked 

8 

closely  with  us  to  ensure  that  they  --  I  don't 

9 

know  if  "closely"  is  the  right  word,  but  they 

10 

worked  with  us  extensively  in  order  to  ensure  that 

11 

they  had  an  accurate  representation  that  could  be 

12 

made  unclassified,  which  was  --  up  until  --  there 

13 

had  --  the  record  had  been  not  as  extensive. 

14 

BY  MR.  ABDO: 

15 

Q  Okay.  Are  you  aware  of  any 

16 

inaccuracies,  factual  inaccuracies,  in  the  report 

17 

marked  as  Exhibit  43? 

18 

MR.  PATTON:  Object  to  form,  vague. 

19 

THE  WITNESS:  If  there's  particular 

20 

sentences  you  would  like  me  to  look  at  or  there's 

21 

particular  questions  that  you  have,  I ' d  be  happy 

22 

to  look  at  those  and  walk  through. 
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As  a  general  matter,  the  information 
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2 

in  here  is  accurate  as  a  description,  but 

3 

necessarily,  as  I  mentioned  before,  not  a  full 

4 

description  of  the  program  because  many  of  those 

5 

facts  still  remain  unclassified.  But  if  there's 

6 

particular  sentences  that  you  would  like  to  point 

7 

me  to,  I'm  happy  to  review. 

8 

I  would  also  note  that,  as  of  2017, 

9 

NSA  changed  one  of  the  ways  it  was  doing  its 

10 

collection,  so  it  was  no  longer  getting  "abouts" 

11 

collection.  And  so  to  the  extent  the  material  in 

12 

here  accurately  reflects  what  was  happening  in 

13 

2014,  the  general  matter,  there  may  be,  you  know. 

14 

slight,  slight  differences,  but  this  is  true. 

15 

That  information  has  changed,  so  we 

16 

are  no  longer  doing  a  collection  that  gets  the. 

17 

quote,  "abouts"  collection  in  upstream.  So  to  the 

18 

extent  that  that's  no  longer  accurate,  that  would 

19 

be  the  case . 

20 

BY  MR.  ABDO: 

21 

Q  But  at  least  as  the  NSA  was  conducting 

22 

upstream  surveillance  as  of  July  2nd,  2014,  which 
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is  the  date  of  that  report,  you're  not  aware  of 

Page  108 

2 

inaccuracies  in  the  report? 

3 

A  Again,  I  would  ask  -- 

4 

MR.  PATTON:  Sorry,  just  object  to 

5 

asked  and  answered.  Go  ahead,  you  can  answer. 

6 

THE  WITNESS:  Again,  if  there  are 

7 

specific  sentences  you  would  like  me  to  go  to  that 

8 

you  think  maybe  are  not  accurate,  I'm  happy  to 

9 

talk  about  those  particular  sentences.  It's  a 

10 

191-page  document. 

11 

As  a  general  matter,  NSA  considers 

12 

this  to  be  an  accurate  outline  of  the  unclassified 

13 

portions  of  Upstream.  There  may  be  particular 

14 

sentences  as  they  describe  them,  but  the  facts  we 

15 

believe  to  be  accurate. 

16 

BY  MR.  ABDO: 

17 

Q  Okay.  I  want  to  turn  your  attention 

18 

to  page  36  of  the  report  marked  Exhibit  43.  Could 

19 

you  please  read  the  first  sentence  of  the  very 

20 

last  paragraph  that  starts  on  that  page?  It 

21 

begins  "once  tasked."  Again,  that's  at  the  bottom 

22 

of  page  36  of  Exhibit  43,  and  that  sentence  ends 
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on  the  next  page,  37. 
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2 

A  Okay,  yes. 

3 

Q  Is  that  sentence  factually  accurate? 

4 

MR.  PATTON:  Object  to  the  form. 

5 

vague . 

6 

BY  MR.  ABDO: 

7 

Q  As  of  the  time  --  let  me  start  over. 

8 

Is  the  sentence  that  I  just  asked  you 

9 

to  read  at  the  bottom  of  page  36,  carrying  over 

10 

onto  page  37  of  Exhibit  43,  an  accurate 

11 

description  of  how  upstream  surveillance  operated 

12 

as  of  July  2nd,  2014? 

13 

A  Well,  what  I  would  do  is  I  would  point 

14 

you,  rather  than  to  the  sentence  that's  on  page  36 

15 

of  the  PCLOB  report,  and  instead  suggest  that  the 

16 

REA,  Request  for  Admission,  on  page  9,  in  response 

17 

to  REA  for  No.  8,  that  describes  how  this  is  -- 

18 

how  the  government  describes  it. 

19 

The  other  place  I  would  suggest,  which 

20 

is  the  government's  description,  is  also  in  the 

21 

NSA  Civil  Liberties  and  Privacy  Office  Report  at 

22 

page  5  . 
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1 

Those  are  both  more  accurate 

Page  110 

2 

descriptions  of  how  we  would  talk  about  Upstream. 

3 

The  description  on  page  36  is  necessarily  vague. 

4 

Q  What's  inaccurate  about  the  sentence 

5 

at  the  bottom  of  page  36,  carrying  over  onto 

6 

page  37,  in  Exhibit  43? 

7 

MR.  PATTON:  Objection, 

8 

mischaracterizes  prior  testimony.  And  just  a 

9 

second,  there  might  be  a  classified  response. 

10 

We  will  need  to  find  out  what  her 

11 

answer  is  going  to  be  on  this  to  determine  whether 

12 

the  answer  is  partially  classified,  fully 

13 

classified,  or  wholly  unclassified.  At  this 

14 

point,  I  don't  know  what  her  answer  is  going  to 

15 

be . 

16 

MS.  HANLEY  COOK:  Why  don't  we  take  a 

17 

five-minute  break. 

18 

MR.  ABDO:  Go  off  the  record.  Dawn, 

19 

please . 

20 

(Off  the  record  at  11:30  a.m.) 

21 

(Resume  at  11:56  a.m.) 

22 

MR.  ABDO:  Ms.  Jaques,  do  you  mind 
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reading  back  the  last  question  before  we  broke? 

Page  ill 

2 

(The  reporter  read  back  the  question.) 

3 

MR.  PATTON:  Objection  to  the  extent 

4 

it  misstates  prior  testimony,  and  objection  to  the 

5 

extent  that  the  answer  calls  for  classified 

6 

information  and  information  subject  to  the 

7 

statutory  privileges. 

8 

You  can  answer  to  the  extent  your 

9 

answer  is  unclassified. 

10 

THE  WITNESS:  Okay.  So  this  sentence. 

11 

as  I  mentioned  about  the  entire  document  and  the 

12 

sort  of  public  description  of  Upstream,  is 

13 

necessarily  incomplete  because  of  the 

14 

classification  of  information. 

15 

This  sentence  is  accurate  as  of  2014, 

16 

but  I  would  point  you  to  the  description  that's 

17 

provided  in  the  REA,  Request  for  Admission  No.  8, 

18 

in  the  response.  That  provides  an  accurate 

19 

description  of  how  upstream  Internet  collection 

20 

works  today,  with,  again,  the  understanding  that 

21 

it's  necessarily  incomplete. 

22 

To  provide  you  a  description  of  what 
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is  different  between  those  two  and  why  necessarily 

Page  112 

2 

gets  into  the  classified  realm,  and  so  I  can't  go 

3 

any  further 

into  that. 

4 

BY  MR.  ABDO: 

5 

Q 

Let  me  just  make  sure  I  understand. 

6 

A 

Yep . 

7 

Q 

Is  it  true  that  the  sentence  we've 

8 

been  focusing  on,  the  carryover  sentence  between 

9 

pages  36  and  37  of  Exhibit  43,  is  accurate  as  of 

10 

2014? 

11 

MR.  PATTON:  Objection, 

12 

mischaracterizes  prior  testimony. 

13 

THE  WITNESS:  It  is  accurate,  but 

14 

incomplete. 

and  that's  a  very  important  fact. 

15 

BY  MR.  ABDO: 

16 

Q 

And  the  reasons  why  it  is  incomplete 

17 

you  are  saying  are  classified;  is  that  correct? 

18 

A 

That  is  correct. 

19 

Q 

Is  it  incomplete  because  it  omits 

20 

additional 

information  about  the  operation  of 

21 

upstream  surveillance  that  is  classified? 

22 

MR.  PATTON:  Let  me  just  check  to  find 
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out  whether  the  answer  is  yes  or  no. 
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2 

(Counsel  conferring.) 

3 

THE  WITNESS:  Ask  your  question  one 

4 

more  --  can  you  repeat  the  question  for  me? 

5 

BY  MR.  ABDO: 

6 

Q  I  can  ask  it  again. 

7 

Is  the  sentence  that  carries  over 

8 

between  pages  36  and  37  of  Exhibit  43  incomplete. 

9 

which  is  the  word  you  used  -- 

10 

A  Correct. 

11 

Q  --  because  it  omits  information  about 

12 

the  operation  of  upstream  surveillance  that  is 

13 

classified? 

14 

MR.  PATTON:  Just  a  second. 

15 

You  can  answer  yes  or  no. 

16 

THE  WITNESS:  Okay,  yes. 

17 

BY  MR.  ABDO: 

18 

Q  Is  it  incomplete  for  any  other  reason 

19 

other  than  that  it  omits  additional  information 

20 

that  is  classified  about  the  operation  of  upstream 

21 

surveillance? 

22 

MR.  PATTON:  Object  to  form,  but  you 
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can  answer. 
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2 

THE  WITNESS:  It  is  incomplete  because 

3 

it  omits  classified  information. 

4 

I'm  not  sure  I  understood  your  second 

5 

question,  what  you  were  trying  to  --  what  my 

6 

other  --  what  other  options  you're  providing  for. 

7 

BY  MR.  ABDO: 

8 

Q  A  statement  could  be  incomplete  for  a 

9 

number  of  reasons.  It  could  be  incomplete  because 

10 

it  omits  relevant  information,  it  could  be 

11 

incomplete  because  it  includes  information  that  is 

12 

inaccurate  or  misleading,  and  I'm  trying  to 

13 

understand  why  the  NSA  believes  this  sentence  is 

14 

incomplete? 

15 

A  It's  incomplete  because  it  omits  the 

16 

classified  information. 

17 

Q  And  for  no  other  reason? 

18 

A  Not  that  I  can  think  of.  I'm  pausing 

19 

because  I  can't  --  I  guess  maybe  you  can  be  more 

20 

specific,  but  I  guess  you  said  I  could  have  added 

21 

more  information  in  --  they  could  have  added  more 

22 

information  into  it  and  that's  what  makes  it 
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incomplete?  I'm  not  sure  I  understand.  I  guess  I 
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2 

don't  understand  beyond  omitting. 

3 

I'm  willing  say  to  say  it's  incomplete 

4 

because  it's  omitting  information.  I'm  not  sure  I 

5 

understand  the  remainder  of  what  you're  trying  to 

6 

get  at,  so  maybe  you  can  rephrase  it. 

7 

Q  Let  me  ask  it  another  way. 

8 

Is  any  of  the  information  included  in 

9 

this  sentence  --  again,  the  sentence  carrying  over 

10 

from  pages  36  to  37  of  Exhibit  43  --  inaccurate? 

11 

MR.  PATTON:  Objection,  vague  as  to 

12 

time . 

13 

MR.  ABDO:  As  to  the  operation  of 

14 

upstream  surveillance  in  2014. 

15 

THE  WITNESS:  As  I've  said,  it's 

16 

incomplete . 

17 

BY  MR.  ABDO: 

18 

Q  I'm  asking  if  it's  inaccurate. 

19 

A  No.  I've  stated  it's  accurate.  It's 

20 

just  incomplete. 

21 

Q  Is  it  inaccurate  as  to  the  operation 

22 

of  upstream  surveillance  today? 
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MR.  PATTON:  Objection,  calls  for 
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2 

information  that  is  classified  and  subject  to  the 

3 

state  secrets  privilege,  the  other  statutory 

4 

privileges 

I  instruct  the  witness  not  to  answer 

5 

the  question. 

6 

BY  MR.  ABDO: 

7 

Q 

Are  you  going  to  follow  your  lawyer's 

8 

instruction  not  to  answer? 

9 

A 

I'm  going  to  follow  my  lawyer's 

10 

direction 

not  to  answer. 

11 

Q 

Do  you  know  the  answer  to  the  question 

12 

that  I  asked?  In  other  words,  if  you  were  to 

13 

answer,  could  you? 

14 

A 

It  would  be  classified,  so  I  can't 

15 

answer  it 

because  it's  classified. 

16 

Q 

But  do  you  know  the  information  that 

17 

you  would 

provide  in  response  but  for  -- 

18 

A 

The  classification? 

19 

Q 

Yes  . 

20 

A 

Yes . 

21 

Q 

Is  there  anything  you  can  say  in 

22 

response  to  the  question  without  revealing 
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information  you've  been  instructed  not  to  provide? 
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2 

A  I  would  point  you  to  the  answer  to  the 

3 

response  that's  on  page  9  of  the  RFA,  which 

4 

accurately,  to  the  extent  possible  given  the 

5 

classified  nature,  describes  the  current  way 

6 

Upstream  works.  And  so  I  would  --  that's  how  I 

7 

would  answer. 

8 

Q  But  specifically  with  respect  to  this 

9 

sentence,  is  there  anything  you  can  say  in 

10 

response  to  my  question,  which  was  is  the  sentence 

11 

accurate  as  to  the  operation  of  upstream 

12 

surveillance  today? 

13 

Is  there  anything  you  can  say,  aside 

14 

from  pointing  me  to  other  testimony  or  other 

15 

information,  that  would  not  require  you  to 

16 

disclose  classified  information? 

17 

A  No. 

18 

Q  Can  you  describe  --  well,  let  me  ask 

19 

you  this.  Do  you  agree  with  your  lawyer's 

20 

instruction  that  answering  the  question  would  harm 

21 

national  security? 

22 

MR.  PATTON:  I'm  going  to  object  to 
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the  form  of  the  question  as  it  seeks  a  legal 
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2 

conclusion,  and  as  my  colleagues  just  pointed  out. 

3 

beyond  the  scope  of  30(b)  (6)  . 

4 

MR.  ABDO:  You  should  take  a  look  at 

5 

guideline  7  of  Appendix  A  of  the  local  rules. 

6 

which  clearly  contemplates  counsel  asking  for  the 

7 

basis  of  assertions  of  privilege. 

8 

So  my  question  is  -- 

9 

MR.  PATTON:  Same  objection.  That 

10 

calls  for  a  legal  conclusion. 

11 

BY  MR.  ABDO: 

12 

Q  Do  you  believe  that  answering  the 

13 

question  would  result  in  harm  to  national 

14 

security? 

15 

A  Yes . 

16 

Q  Can  you  describe  that  harm? 

17 

MR.  PATTON:  No.  I'm  going  to  object 

18 

to  that  question,  as  it  would  call  for  classified 

19 

information  and  information  subject  to  the 

20 

statutory  privileges,  and  I'll  instruct  her  not  to 

21 

answer  the  question. 

22 
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BY  MR.  ABDO: 
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2 

Q 

Do  you  agree  that  describing  the  harm 

3 

would  itself  result  in  harm  to  national  security? 

4 

A 

Yes  . 

5 

Q 

Have  you  discussed  the  invocation  of 

6 

the  state  secrets  privilege  with  respect  to  this 

7 

question  with  Admiral  Michael  Rogers? 

8 

MR.  PATTON:  With  respect  to  this 

9 

particular 

question? 

10 

MR.  ABDO:  Yes. 

11 

THE  WITNESS:  The  question  being  -- 

12 

I ' m  sorry. 

so  just  explain  to  me.  The  question  is 

13 

whether  describing  the  difference  between  the 

14 

sentence  on 

page  36  and  the  interrogatory  --  or 

15 

the  Request 

for  Admission  on  page  9,  whether 

16 

describing 

what  is  different  between  those  two 

17 

would  be  a 

national  security  harm  with  him 

18 

specifically? 

19 

BY  MR.  ABDO: 

20 

Q 

No.  The  original  question  was  whether 

21 

the  carryover  sentence  from  page  36  to  37  of 

22 

Exhibit  43 

is  accurate  with  respect  to  upstream 
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surveillance  as  it  is  conducted  today. 
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2 

Have  you  discussed  with  Admiral  Rogers 

3 

whether  answering  a  question  seeking  that 

4 

information  requires  invocation  of  the  state 

5 

secrets  privilege? 

6 

MR.  PATTON:  You  can  answer  the 

7 

question . 

8 

THE  WITNESS:  No,  I  have  not. 

9 

BY  MR.  ABDO: 

10 

Q  Have  you  more  generally  discussed  the 

11 

invocation  of  the  state  secrets  privilege  in  this 

12 

deposition  with  Admiral  Rogers? 

13 

A  I  spoke  to  him  extensively  prior  to 

14 

the  issuance  of  both  the  NSA  Civil  Liberties  and 

15 

Privacy  Office  Report,  as  well  as  the  PCLOB 

16 

Report,  for  him  to  understand  what  information  was 

17 

going  to  be  in  that. 

18 

So  whether  for  today's  testimony  --  I 

19 

did  not  go  back  to  him  and  ask  him  specifically 

20 

about  any  of  this  information,  as  that  had  largely 

21 

been  covered  when  we  were  issuing  those  reports 

22 

back  in  2014. 
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Q 

Okay.  Is  there  anything  else  you  can 
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2 

tell  us  about  this  assertion  of  the  state  secrets 

3 

privilege? 

4 

MR.  PATTON:  Objection,  vague. 

5 

THE  WITNESS:  I  don't  know  what  you're 

6 

asking  me. 

7 

BY  MR.  ABDO: 

8 

Q 

Is  there  anything  that  you  can  say 

9 

that  would 

be  unclassified  about  the  nature  of  the 

10 

state  secrets  privilege  invocation,  or  the  reason 

11 

for  it,  or 

the  harm  that  would  come  about  by 

12 

answering  the  question? 

13 

A 

No,  other  than  to  say  that  this  is 

14 

sources  and 

methods.  You're  getting  into  sources 

15 

and  methods 

,  which  is  what  we  have  --  we  protect 

16 

extensively 

• 

17 

Q 

Okay.  As  of  2014,  did  the  NSA  conduct 

18 

upstream  surveillance  on  at  least  one  Internet 

19 

backbone  circuit? 

20 

MR.  PATTON:  Object  to  the  question  to 

21 

the  extent 

it  calls  for  a  classified  answer. 

22 

subject  to 

the  state  secrets  privilege,  prior 
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1 

statutory  privileges. 

2 

You  can  answer  the  question  to  the 

3 

extent 

not  classified. 

4 

THE  WITNESS:  The  question  is  at  least 

5 

one? 

6 

BY  MR.  ABDO: 

7 

Q  Internet  backbone  circuit. 

8 

A  One  Internet  backbone  circuit. 

9 

MR.  PATTON:  This  is  probably  another 

10 

one  of 

those  questions  where  a  yes-or-no  answer 

11 

would 

be  unclassified,  but  -- 

12 

MR.  ABDO:  That's  what  I'm  looking 

13 

for,  a 

yes  or  no. 

14 

MR.  PATTON:  Any  narrative  answer  we 

15 

would 

have  to  break  for. 

16 

THE  WITNESS:  At  least  one  Internet  — 

17 

BY  MR.  ABDO: 

18 

Q  Let  me  restate  the  question. 

19 

A  Okay. 

20 

Q  As  of  2014,  did  the  NSA  conduct 

21 

upstream  surveillance  on  at  least  one  Internet 

22 

backbone  circuit?  Yes  or  no. 
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MR.  PATTON:  Same  classified 
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2 

objections  to  the  extent  that  the  question  seeks 

3 

classified  information.  To  the  extent  it's  yes  or 

4 

no,  you  can  answer  the  question. 

5 

THE  WITNESS:  Yes. 

6 

BY  MR.  ABDO: 

7 

Q  As  of  2014,  did  the  NSA  conduct 

8 

upstream  surveillance  on  more  than  one  Internet 

9 

backbone  circuit? 

10 

MR.  PATTON:  Object  to  that  question 

11 

to  the  extent  it  calls  for  classified  information 

12 

protected  by  the  state  secrets  privilege. 

13 

statutory  privilege. 

14 

Instruct  the  witness  not  to  answer  the 

15 

question . 

16 

THE  WITNESS:  I  will  follow  my 

17 

lawyer's  direction. 

18 

BY  MR.  ABDO: 

19 

Q  Your  view  is  that  stating  a  yes  in 

20 

response  to  that  question  or  a  no  in  response  to 

21 

that  question  would  disclose  state  secrets? 

22 

MR.  PATTON:  Same  objection,  same 
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instruction . 
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2 

THE  WITNESS:  Still  following  my 

3 

lawyer's  description  --  direction. 

4 

BY  MR.  ABDO: 

5 

Q  Is  -- 

6 

MR.  GILLIGAN:  Excuse  me.  Counsel, 

7 

just  one  moment. 

8 

MR.  ABDO:  Yeah,  sorry. 

9 

(Counsel  conferring.) 

10 

BY  MR.  ABDO: 

11 

Q  Is  your  view  that  the  sentence  we've 

12 

been  discussing  between  pages  36  and  37  of 

13 

Exhibit  43  discloses  any  classified  facts  or  facts 

14 

protected  by  the  statutory  authorities  your 

15 

counsel  has  cited? 

16 

A  The  sentence  is  unclassified. 

17 

Q  Is  that  true  notwithstanding  the  fact 

18 

that  the  sentence  states  that  upstream 

19 

surveillance  involves  the  acquisition  of 

20 

communications  transiting  through  circuits  -- 

21 

that's  a  quote  --  on  the  Internet  backbone? 

22 

MR.  PATTON:  Object  to  the  form  of  the 
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1 

question. 

vague  as  to  time. 

2 

MR.  ABDO:  As  of  2014. 

3 

MR.  PATTON:  Same  objections,  vague  as 

4 

to  time. 

5 

THE  WITNESS:  My  answer  remains  the 

6 

same . 

7 

BY  MR.  ABDO: 

8 

Q 

What's  your  answer? 

9 

A 

That  the  fact  that  the  word  "circuits" 

10 

is  plural 

does  not  change  any  of  my  previous 

11 

answers . 

12 

Q 

You  don't  view  that  as  inconsistent 

13 

with  the 

assertion  of  the  state  secrets  privilege 

14 

in  response  to  my  question  of  whether,  as  of  2014, 

15 

upstream 

surveillance  involved  more  than  one 

16 

Internet 

backbone  circuit? 

17 

MR.  PATTON:  Objection,  asked  and 

18 

answered. 

argumentative.  Go  ahead. 

19 

THE  WITNESS:  I  don't  see  that  as 

20 

inconsistent . 

21 

BY  MR.  ABDO: 

22 

Q 

Why  not? 
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MR.  PATTON:  Same  objections. 
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2 

THE  WITNESS:  As  we've  stated,  we've 

3 

stated  that  we  were  on  at  least  one,  and  the  fact 

4 

that  there's  a  plural  there  isn't  dispositive  one 

5 

way  or  the  other. 

6 

BY  MR.  ABDO: 

7 

Q  As  of  2014,  were  multiple  electronic 

8 

communication  service  providers  compelled  to 

9 

assist  the  NSA  in  the  operation  of  upstream 

10 

surveillance? 

11 

MR.  PATTON:  Objection,  calls  for 

12 

classified  information,  sources  and  methods. 

13 

operational  details,  and  subject  to  state  secrets 

14 

and  statutory  privileges. 

15 

I  instruct  the  witness  not  to  answer 

16 

the  question. 

17 

THE  WITNESS:  I  will  follow  my 

18 

lawyer's  -- 

19 

BY  MR.  ABDO: 

20 

Q  Can  you  please  turn  to  page  12  of 

21 

what's  marked  Exhibit  43  and  read,  if  you  would. 

22 

what  is  marked  as  Recommendation  6,  which  is  the 
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final  paragraph  of  page  12. 
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2 

MR.  PATTON:  Read  it  to  herself  or  out 

3 

loud? 

4 

MR.  ABDO:  To  yourself,  yeah. 

5 

THE  WITNESS:  Yes. 

6 

BY  MR.  ABDO: 

7 

Q  Do  you  understand  --  well,  strike 

8 

that . 

9 

Is  it  true  that  in  the  operation  of 

10 

upstream  surveillance  in  2014,  there  were  --  and 

11 

I'm  quoting  from  this  recommendation  --  affected 

12 

telecommunication  service  providers? 

13 

MR.  PADGETT:  Could  you  read  back  the 

14 

question? 

15 

(The  reporter  read  back  the  question.) 

16 

MR.  PATTON:  I'm  going  to  object  to 

17 

vagueness  in  terms  of  time,  and  object  to  the 

18 

question  to  the  extent  it  calls  for  classified 

19 

information,  sources  and  methods  information 

20 

protected  by  the  statutory  privileges. 

21 

The  witness  can  answer  the  question  to 

22 

the  extent  unclassified. 
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1 

BY  MR.  ABDO: 

2 

Q  Let  me  specify  with  respect  to 

time 

3 

that  I'm  talking  about  July  2nd,  2014,  the 

date  of 

4 

this  report. 

5 

MR.  PATTON:  Same  objections. 

6 

THE  WITNESS:  I'd  like  to  go  in 

the 

7 

SCIE  before  I  answer  this  question. 

8 

MR.  PATTON:  Okay. 

9 

MR.  ABDO:  Take  a  break. 

10 

(Off  the  record  at  12:16  p.m.) 

11 

(Resume  at  12:19  p.m.) 

12 

MR.  PATTON:  Same  objections. 

13 

THE  WITNESS:  So  as  I  said  earlier. 

14 

providing  any  information  as  to  the  number 

of 

15 

telecommunication  service  provider  beyond  one  is 

16 

classified.  Because  this  is  temporally  at 

one 

17 

point,  we  can  neither  confirm  nor  deny  that 

18 

information,  whether  it  was  more  than  one. 

To  the 

19 

extent  there  was  more  than  --  to  the  extent 

there 

20 

is  a  program,  there  must  be  one. 

21 

BY  MR.  ABDO: 

22 

Q  Can  you  tell  us  whether  there  have 
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2 

more  than  one  at  the  same  time? 

3 

MR.  PATTON:  Objection,  calls  for 

4 

classified  information  pursuant  to  the  state 

5 

secrets  privilege.  Instruct  the  witness  not  to 

6 

answer,  and  to  the  statutory  privileges. 

7 

THE  WITNESS:  I  will  follow  my 

8 

lawyer's  direction. 

9 

MR.  ABDO:  Rodney,  are  you  okay 

10 

shortening  that  objection  to  something? 

11 

MR.  PATTON:  I'm  trying. 

12 

MR.  ABDO:  Okay. 

13 

Ms.  Jaques,  do  you  mind  marking  this 

14 

as  Exhibit  44? 

15 

(Deposition  Exhibit  44  was 

16 

marked  for  identification.) 

17 

BY  MR.  ABDO: 

18 

Q  Ms.  Richards,  you  have  in  front  of  you 

19 

what's  been  marked  as  Exhibit  44.  Do  you 

20 

recognize  that  document? 

21 

A  Yes,  I  do. 

22 

Q  Did  you  draft  this  document? 
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A 

I  did . 

Page  130 

2 

Q 

What  is  the  document? 

3 

A 

The  document  is  the  NSA  Director  of 

4 

Civil  Liberties  and  Privacy  Office  Report,  NSA's 

5 

Implementation  of  Foreign  Intelligence 

6 

Surveillance  Act,  Section  702,  dated  April  16th, 

7 

2014.  It 

's  exactly  four  years  old. 

8 

Q 

Did  the  NSA  review  this  document  for 

9 

accuracy 

and  classification? 

10 

A 

Did  the  NSA? 

11 

Q 

Yes . 

12 

A 

Yes,  it  did. 

13 

Q 

Was  that  review  thorough? 

14 

A 

Yes,  it  was. 

15 

MR.  PATTON:  Objection,  vague. 

16 

THE  WITNESS:  Sorry,  too  fast. 

17 

BY  MR.  ABDO: 

18 

Q 

What  was  the  purpose  of  issuing  this 

19 

report? 

20 

A 

The  purpose  of  issuing  the  report  was 

21 

to  put  on 

the  public  record  a  description  from 

22 

NSA's  perspective  of  what  the  privacy  protections 
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were  in  place  as  it  relates  to  Section  702. 

Page  131 

2 

Q 

Was  it  important  to  the  NSA  in  issuing 

3 

Exhibit  44 

that  the  report  be  accurate? 

4 

A 

Absolutely . 

5 

Q 

And  why  is  that? 

6 

A 

Because  this  was  submitted  to  the 

7 

Privacy  and  Civil  Liberties  Oversight  Board  as 

8 

part  of  their  request  for  comment  as  part  of  their 

9 

report  on 

Section  702,  and  we  wanted  to  put  on 

the 

10 

record  an 

unclassified  description  that  NSA  stood 

11 

behind  as 

to  how  the  program  worked. 

12 

Q 

And  was  it  also  important  that  the 

13 

report,  to 

the  extent  publicly  disclosed,  not 

14 

reveal  classified  information? 

15 

A 

Yes . 

16 

Q 

Could  you  turn  to  page  5  of  the 

17 

report,  again  what's  marked  as  Exhibit  44?  I 

want 

18 

to  direct 

your  attention  to  the  first  sentence 

of 

19 

the  last  paragraph  of  the  page,  which  starts. 

"In 

20 

the  second 

Tf 

21 

A 

Mm-hmm . 

22 

Q 

Could  you  read  that  sentence  to 
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1 

yourself. 

please,  and  let  me  know  when  you're 

2 

done . 

3 

A 

(Witness  reviewing  document.)  Okay. 

4 

Q 

Is  this  sentence  referring  to  upstream 

5 

surveillance  as  it  operated  as  of  April  16,  2014? 

6 

A 

Yes,  it  is. 

7 

Q 

Does  this  sentence  confirm  that 

8 

service  providers,  plural,  are  compelled  to  assist 

9 

the  NSA  in 

the  lawful  interception  of  electronic 

10 

communications  to,  from,  or  about  task  selectors 

11 

as  of  April  16th,  2014? 

12 

MR.  PATTON:  Just  a  moment. 

13 

(Counsel  conferring.) 

14 

MR.  PADGETT:  Can  you  read  back  the 

15 

question? 

16 

(The  reporter  read  back  the  question.) 

17 

BY  MR.  ABDO: 

18 

Q 

Let  me  ask  it  differently. 

19 

Is  this  sentence  accurate  as  of 

20 

April  16, 

2014? 

21 

A 

To  the  extent,  as  with  the  PCLOB 

22 

report,  it 

's  necessarily  incomplete.  It  is 
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1 

accurate  to  the  outline  of  how  the  program  works. 

2 

Q 

When  you  say  it's  incomplete,  is  it 

3 

incomplete 

because  it  omits  classified  information 

4 

about  the 

operation  of  upstream  surveillance  as  of 

5 

April  16, 

2014? 

6 

A 

Yes . 

7 

Q 

Is  it  incomplete  for  any  other  reason? 

8 

A 

No. 

9 

Q 

Do  you  understand  this  sentence  to 

10 

confirm  that  service  providers  are  compelled  to 

11 

assist  NSA 

in  the  lawful  interception  of 

12 

electronic 

communications  to,  from,  or  about  task 

13 

selectors 

as  of  April  16th,  2014? 

14 

MR.  PATTON:  Just  a  moment. 

15 

(Counsel  conferring.) 

16 

MR.  PATTON:  We  need  to  take  just,  I 

17 

promise,  a 

very  short  break  to  make  sure  the 

18 

answer  is 

unclassified.  Thanks. 

19 

(Off  the  record  at  12:26  p.m.) 

20 

(Resume  at  12:40  p.m.) 

21 

MR.  ABDO:  Do  you  mind  reading  back 

22 

the  last  question  to  us,  Ms.  Jaques? 
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(The  reporter  read  back  the  question.) 
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2 

MR.  PATTON:  Objection,  vague  as  to 

3 

time,  and  objection  to  the  extent  it  seeks 

4 

classified  and  otherwise  statutorily  privileged 

5 

information . 

6 

You  can  answer  to  the  extent  it's 

7 

unclassified . 

8 

THE  WITNESS:  So  this  sentence  — 

9 

here's  the  thing.  Would  it  have  been  clearer  if 

10 

we  had  put  parens  between  the  S?  Yes.  But  we're 

11 

not  here  --  we  can't  confirm  or  deny  whether  -- 

12 

we've  said  that  there  was  one  service  provider,  at 

13 

least  one  service  provider  in  Upstream.  The  fact 

14 

that  this  is  plural  does  not  --  is  not  an 

15 

indication  that  it  was  more  than  one  at  that  point 

16 

in  time  or  less  than  one  at  that  point  in  time. 

17 

And  so  this  is  just  --  it  probably 

18 

would  have  been  clearer  if  we  had  put  the  parens. 

19 

We  didn't  put  the  parens,  so  you've  found  the  S's 

20 

in  our  report,  but  it's  not  meant  to  have  provided 

21 

classified  information,  the  fact  that  the  numbers 

22 

are  classified. 
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BY  MR.  ABDO: 

Page  135 

2 

Q  You  understand  that  at  the  time  that 

3 

this  report  was  issued  --  and  for  the  record. 

4 

we're  talking  about  Exhibit  44  --  there  was  a 

5 

relatively  small  amount  of  unclassified 

6 

information  available  from  the  government  about 

7 

the  operation  of  upstream  surveillance,  right? 

8 

MR.  PATTON:  Objection,  vague. 

9 

THE  WITNESS:  Yes,  that's  why  I  wrote 

10 

the  report. 

11 

BY  MR.  ABDO: 

12 

Q  And  you  understand  that  the  public  and 

13 

the  PCLOB,  which  received  this  report,  would 

14 

regard  it  as  an  authoritative  source  of  public 

15 

information  from  the  government  about  the 

16 

operation  of  upstream  surveillance? 

17 

MR.  PATTON:  Objection,  calls  for 

18 

speculation  about  others  and  their  thought 

19 

processes . 

20 

THE  WITNESS:  Yes. 

21 

BY  MR.  ABDO: 

22 

Q  And  that  was  precisely  one  of  the 
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1 

reasons  that  you  drafted  it  and  disclosed 

the 

2 

report,  right? 

3 

A  Correct. 

4 

MR.  PATTON:  Objection. 

5 

BY  MR.  ABDO: 

6 

Q  Were  you  careful  throughout  to 

ensure 

7 

that  the  factual  assertions  in  this  report 

were 

8 

accurate? 

9 

MR.  PATTON:  Objection,  vague. 

10 

THE  WITNESS:  Yes. 

11 

BY  MR.  ABDO: 

12 

Q  And  was  that  in  part  at  least 

so  as 

13 

not  to  mislead  the  public  or  the  PCLOB  as 

to  the 

14 

operation  of  upstream  surveillance  at  the 

time  the 

15 

report  was  issued? 

16 

A  Yes . 

17 

Q  Did  you  take  great  care  throughout  the 

18 

rest  of  the  report  in  every  word  used  to  ensure 

19 

that  what  the  words  conveyed  were  accurate 

and 

20 

unclassified? 

21 

MR.  PATTON:  Objection,  vague. 

22 

THE  WITNESS:  Yes. 
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BY  MR.  ABDO: 
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2 

Q  Was  this  sentence  reviewed  with  that 

3 

same  level  of  care? 

4 

MR.  PATTON:  Objection,  vague. 

5 

THE  WITNESS:  Yes. 

6 

BY  MR.  ABDO: 

7 

Q  Are  you  aware  of  any  factually 

8 

incorrect  statements  in  Exhibit  44  as  to  the 

9 

operation  of  upstream  surveillance  at  the  time 

10 

that  the  report  purports  to  describe  the  operation 

11 

of  upstream  surveillance? 

12 

MR.  PATTON:  Objection,  ambiguous. 

13 

MR.  ABDO:  I'm  sorry,  I  didn't  hear. 

14 

MR.  PATTON:  Objection,  ambiguous. 

15 

THE  WITNESS:  Again,  to  the  extent 

16 

that  the  information  in  here  is  unclassified,  and 

17 

therefore  is  necessarily  incomplete,  yes,  this  is 

18 

an  accurate  description. 

19 

This  was  also  really  one  of  the  first 

20 

times  that  the  NSA  had  written,  so  to  the  extent 

21 

we've  gotten  better  at  this  as  we've  gone  along. 

22 

the  first  time  is  always  --  we  were  doing  our 
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best . 
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2 

BY  MR.  ABDO: 

3 

Q  Setting  aside  the  question  of 

4 

incomplete  information,  are  you  aware  of  any 

5 

factual  inaccuracies  in  Exhibit  44  as  to  the 

6 

operation  of  upstream  surveillance  at  the  relevant 

7 

time  periods  described  in  the  report? 

8 

MR.  PATTON:  Just  a  moment. 

9 

(Counsel  conferring.) 

10 

MR.  PATTON:  Go  ahead. 

11 

THE  WITNESS:  No,  I'm  not. 

12 

BY  MR.  ABDO: 

13 

Q  Also  setting  aside  the  question  of 

14 

incompleteness,  are  you  aware  of  any  factual 

15 

inaccuracies  in  Exhibit  43,  the  report  of  the 

16 

PCLOB,  as  to  the  operation  of  upstream 

17 

surveillance  for  the  periods  of  time  described  in 

18 

that  report? 

19 

MR.  PATTON:  Objection,  vague. 

20 

THE  WITNESS:  As  I  said  earlier,  and 

21 

as  we  just  then  described  going  through  these 

22 

different  sentences,  the  answer  is  I  am  not 
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generally  aware  of  any  inaccuracies. 

Page  139 

2 

To  the  extent  you  have  a  question 

3 

about  a  particular  sentence,  I'm  happy  to,  as  we 

4 

did  on  page  36,  walk  you  through  and  understand 

5 

whether  there  was  classified  information  that 

6 

makes  that  sentence  more  or  less  complete. 

7 

BY  MR.  ABDO: 

8 

Q  I  appreciate  that,  and  we  may  do  that 

9 

for  a  few  more  sentences,  but  my  question  is 

10 

whether,  as  you  sit  here  today,  you  are  aware  of 

11 

any  inaccuracies,  factual  inaccuracies,  in 

12 

Exhibit  43  with  regard  to  the  operation  of 

13 

upstream  surveillance  as  the  report  describes? 

14 

MR.  PATTON:  Objection,  asked  and 

15 

answered . 

16 

THE  WITNESS:  My  answer  is  still  the 

17 

same.  You  know,  the  information  in  it  is. 

18 

generally  speaking,  accurate. 

19 

If  there's  a  particular  sentence  you 

20 

want  to  discuss  --  it's  necessarily  incomplete. 

21 

and  describing  Upstream,  which  is  classified,  in 

22 

an  unclassified  sentence  is  difficult,  as  you're 
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seeing  with  us  having  to  walk  back  and  forth  and 

Page  140 

2 

make  sure  that  we're  hitting  those  lines  so  that 

3 

we  are  providing  an  accurate  general  description 

4 

of  the  program  without  going  into  the  classified 

5 

sources  and  methods  of  the  program. 

6 

So,  you  know,  it  still  remains 

7 

accurate  to  the  extent  that  it  was  true  in  2014. 

8 

I'll  just  re-remind  you  that  we  are  no  longer  do 

9 

the  "abouts"  collection  as  it  was  described 

10 

starting  in  2017,  and  so  that  piece  of  this  report 

11 

is  not  accurate. 

12 

BY  MR.  ABDO: 

13 

Q  The  report  doesn't  purport  to  describe 

14 

surveillances  operated  years  later,  correct? 

15 

A  Correct.  I'm  just  re-reminding  that 

16 

to  the  extent  that  we've  changed  certain  aspects 

17 

of  the  program,  that's  no  longer  accurate. 

18 

Q  Okay.  I'm  going  to  ask  you  similar 

19 

questions  that  I  just  asked  you  about  Exhibit  44, 

20 

but  about  Exhibit  43. 

21 

Did  the  NSA,  as  it  did  with 

22 

Exhibit  44,  also  review  each  and  every  factual 
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disclosure  in  Exhibit  43  to  ensure  that  it  was 

Page  141 

2 

accurate? 

3 

MR.  PATTON:  Object  to  the  form. 

4 

vague,  asked  and  answered. 

5 

THE  WITNESS:  To  the  extent  that  NSA 

6 

scrubbed  through  the  facts  provided  in  the 

7 

historical,  as  we  mentioned,  section  from  16  to 

8 

roughly  79,  and  also  looked  at  from  a 

9 

classification  purpose,  yes. 

10 

We  were,  again,  doing  our  best  to  try 

11 

and  help  provide  an  unclassified  description  of  a 

12 

classified  program,  and  so  it  was  necessarily 

13 

incomplete . 

14 

BY  MR.  ABDO: 

15 

Q  And  at  the  time  that  report  was 

16 

issued,  is  it  also  fair  to  say  that  there  was 

17 

relatively  little  public  information  from  the 

18 

government  describing  the  operation  of  upstream 

19 

surveillance? 

20 

MR.  PATTON:  Object  to  the  form. 

21 

vague . 

22 

THE  WITNESS:  I'm  pausing  because  I 
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don't  exactly  remember  when  a  number  of  the 

Page  142 

2 

different  FISC  opinions  were  declassified.  So  I 

3 

believe  that  there  were  a  number  of  --  they  were 

4 

actually  issued  --  that  they  were  declassified 

5 

prior  to  --  or  they  were  reviewed  and  redacted. 

6 

So  Judge  Bates  --  which  are  mentioned. 

7 

There  are  a  number  of  reports  that  are  footnoted 

8 

in  here  that  are  --  that  were  declassified.  I 

9 

just  --  some  of  the  timing. 

10 

BY  MR.  ABDO: 

11 

Q  Is  it  fair  to  say  that  at  the  time 

12 

this  report  was  issued,  it  was  the  most 

13 

comprehensive  description  from  the  government  of 

14 

how  upstream  surveillance  operated  at  the  time  the 

15 

report  was  issued? 

16 

MR.  PATTON:  Objection,  vague. 

17 

THE  WITNESS:  Yes,  to  the  extent. 

18 

though  --  I  would  just  offer  that  to  the  extent 

19 

that  these  are  the  words  of  an  independent 

20 

executive  agency  with  oversight  over  the 

21 

Intelligence  Community  as  it  relates  to  CT 

22 

functions,  you  know,  these  are  their  words. 
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They're  not  NSA's  words.  They're  not  NSA 

Page  143 

2 

submissions . 

3 

And  so  sometimes  they  may  describe 

4 

things  slightly  differently  than  we  may  have 

5 

chosen  to  do  so,  and  so  I  would  refer  you  back  to 

6 

the  NSA  or  the  government  submissions  on  the 

7 

descriptions  of  the  programs. 

8 

BY  MR.  ABDO: 

9 

Q  Okay.  Is  it  fair  to  describe  the 

10 

report  marked  Exhibit  43  as  an  exhaustive 

11 

description  of  upstream  surveillance  as  it 

12 

operated  in  2014? 

13 

MR.  PATTON:  Objection,  vague. 

14 

THE  WITNESS:  I  suppose  that's  one. 

15 

I'm  guessing  that  you  have  something  over  there 

16 

that  --  are  you  referring  to  a  specific  document 

17 

where  NSA  may  have  said  that? 

18 

BY  MR.  ABDO: 

19 

Q  Well,  I'm  asking  you  first  whether 

20 

that's  fair,  setting  aside  what  the  NSA  has 

21 

otherwise  said? 

22 

A  Yes,  I  think  it's  fair. 
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MR.  PATTON:  In  unclassified  terms. 

Page  144 

2 

THE  WITNESS:  In  unclassified  terms. 

3 

MR.  PATTON:  I  guess  that's  probably 

4 

what  that's  talking  about,  right? 

5 

MR.  ABDO:  Yeah,  no,  I  think  --  let  me 

6 

ask  the  question  clearly. 

7 

Is  the  PCLOB ' s  description  of  the 

8 

operation  of  upstream  surveillance  exhaustive? 

9 

MR.  PATTON:  Same  objection. 

10 

THE  WITNESS:  So,  again,  I  think  what 

11 

I  would  say  is  I  think  that  their  study  was 

12 

exhaustive.  To  the  extent  that  there's  classified 

13 

information,  they  had  access  to  that  information. 

14 

which  makes  the  study  probably  exhaustive,  but  to 

15 

the  extent  that  the  report  is  necessarily 

16 

incomplete,  it's  as  much  information  as  possible 

17 

without  going  into  the  classified  material. 

18 

BY  MR.  ABDO: 

19 

Q  Okay.  I  want  to  ask  you  a  question 

20 

that  I've  tried  different  versions  of,  so  forgive 

21 

the  repetition.  I'm  asking  it  multiple  ways 

22 

because  I'm  looking  for  what  I  think  you  ought  to 
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be  able  to  provide,  which  is  a  clean  yes  or  no. 

Page  145 

2 

Setting  aside  the  incompleteness  of 

3 

the  report  marked  Exhibit  43,  are  you  aware  now  of 

4 

any  factual  inaccuracies  in  the  report  and  its 

5 

description  of  upstream  surveillance  as  Upstream 

6 

was  conducted  at  the  time  the  report  was  issued? 

7 

MR.  PATTON:  Objection,  asked  and 

8 

answered.  Go  ahead. 

9 

THE  WITNESS:  I  am  not  aware  of  any 

10 

inaccurate  --  known  inaccuracies  in  the  document 

11 

as  described  other  than  the  fact  that  there's 

12 

classified  information  that  has  been  omitted. 

13 

BY  MR.  ABDO: 

14 

Q  What  is  the  number,  or  approximate 

15 

number,  of  Internet  backbone  circuits  on  which 

16 

upstream  surveillance  is  conducted  -- 

17 

MR.  PATTON:  Objection. 

18 

MR.  ABDO:  —  as  of  June  2015? 

19 

MR.  PATTON:  Objection,  calls  for 

20 

classified  information,  sources  and  methods. 

21 

operational  details  subject  to  state  secrets  and 

22 

the  statutory  privilege. 
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1 

Instruct  the  witness  not  to  answer. 
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2 

THE  WITNESS:  I  will  follow  my 

3 

lawyer's  direction. 

4 

MR.  ABDO:  Rodney,  I  think  it  might  be 

5 

in  our  interest  to  come  up  with  a  shortened 

6 

version  of  that,  at  least  for  the  next  few 

7 

minutes . 

8 

MR.  PATTON:  Yes,  you  have  my  word. 

9 

BY  MR.  ABDO: 

10 

Q  What  is  the  number,  or  approximate 

11 

number,  of  Internet  backbone  circuits  on  which 

12 

upstream  surveillance  is  conducted  today? 

13 

MR.  PATTON:  Same  objection,  same 

14 

instruction . 

15 

THE  WITNESS:  Still  following  those 

16 

directions . 

17 

BY  MR.  ABDO: 

18 

Q  Okay.  What  is  the  average  bandwidth 

19 

of  the  Internet  backbone  circuits  on  which 

20 

upstream  surveillance  was  conducted  in  June  2015? 

21 

MR.  PATTON:  Same  objections,  same 

22 

instruction . 
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1 

THE  WITNESS:  Eollowing  the 
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2 

instruction . 

3 

BY  MR.  ABDO: 

4 

Q  What  is  the  average  bandwidth  of  the 

5 

Internet  backbone  circuits  on  which  upstream 

6 

surveillance  is  conducted  today? 

7 

MR.  PATTON:  Same  objections,  same 

8 

instruction . 

9 

THE  WITNESS:  Still  following  the 

10 

instructions . 

11 

BY  MR.  ABDO: 

12 

Q  What  is  the  approximate  combined 

13 

bandwidth  of  the  Internet  backbone  circuits  on 

14 

which  upstream  surveillance  was  conducted  in  June 

15 

of  2015? 

16 

MR.  PATTON:  Same  objections,  same 

17 

instruction . 

18 

THE  WITNESS:  Still  following 

19 

instructions . 

20 

BY  MR.  ABDO: 

21 

Q  What  is  the  approximate  combined 

22 

bandwidth  of  the  Internet  backbone  circuits  on 
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which  upstream  surveillance  is  conducted  today? 
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2 

MR.  PATTON:  Same  objections,  same 

3 

instruction . 

4 

THE  WITNESS:  Eollowing  instruction. 

5 

BY  MR.  ABDO: 

6 

Q  What  are  the  categories  of  circuits 

7 

that  were  subject  to  upstream  surveillance  in 

8 

June  2015? 

9 

MR.  PATTON:  Same  objection,  same 

10 

instruction . 

11 

THE  WITNESS:  Eollowing  instruction. 

12 

BY  MR.  ABDO: 

13 

Q  What  are  the  categories  of  circuits 

14 

that  are  subject  to  upstream  surveillance  today? 

15 

MR.  PATTON:  Same  objections,  same 

16 

instruction . 

17 

THE  WITNESS:  Eollowing  instruction. 

18 

BY  MR.  ABDO: 

19 

Q  Were  any  individual  optical  fibers  on 

20 

the  Internet  backbone  subjected  to  upstream 

21 

surveillance  in  June  2015  and/or  any  individual 

22 

optical  fibers  on  the  Internet  backbone  subjected 
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to  upstream  surveillance  today? 
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2 

MR.  PATTON:  Just  a  second. 

3 

MR.  PADGETT:  Could  you  read  back  the 

4 

question? 

5 

MR.  ABDO:  Sure.  Let  me  -- 

6 

MR.  PATTON:  I  really  am  listening  to 

7 

your  questions. 

8 

BY  MR.  ABDO: 

9 

Q  I  appreciate  that.  In  the  interest  of 

10 

speed,  I  was  combining  two,  but  let  me  be  clear. 

11 

Are  any  individual  optical  fibers  on 

12 

the  Internet  backbone  subjected  to  upstream 

13 

surveillance  today? 

14 

MR.  PATTON:  Same  objection,  same 

15 

instruction . 

16 

THE  WITNESS:  Eollowing  instruction. 

17 

BY  MR.  ABDO: 

18 

Q  Were  any  individual  optical  fibers  on 

19 

the  Internet  backbone  subjected  to  upstream 

20 

surveillance  as  of  June  2015? 

21 

MR.  PATTON:  Same  objection,  same 

22 

instruction . 
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THE  WITNESS: 

Eollowing  instruction. 
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2 

BY  MR.  ABDO: 

3 

Q  Are  any  subdivisions  of  optical  fibers 

4 

on  the  Internet  backbone 

subjected  to  upstream 

5 

surveillance  today? 

6 

MR.  PATTON: 

Same  objection,  same 

7 

instruction . 

8 

THE  WITNESS: 

Eollowing  instruction. 

9 

BY  MR.  ABDO: 

10 

Q  Were  any  subdivisions  of  optical 

11 

fibers  on  the  Internet  backbone  subjected  to 

12 

upstream  surveillance  in 

June  2015? 

13 

MR.  PATTON: 

Same  objection,  same 

14 

instruction . 

15 

THE  WITNESS: 

Eollowing  instruction. 

16 

BY  MR.  ABDO: 

17 

Q  Are  any  wavelengths  of  light  carried 

18 

on  optical  fibers  on  the 

Internet  backbone 

19 

subjected  to  upstream  surveillance  today? 

20 

MR.  PATTON: 

Same  objection,  same 

21 

instruction . 

22 

THE  WITNESS: 

Eollowing  instruction. 
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BY  MR.  ABDO: 
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2 

Q 

Were  any  wavelengths  of  light  carried 

3 

on  optical 

fibers  on  the  Internet  backbone 

4 

subjected 

to  upstream  surveillance  in  June  2015? 

5 

MR.  PATTON:  Same  objection,  same 

6 

instruction . 

7 

THE  WITNESS:  Eollowing  instruction. 

8 

BY  MR.  ABDO: 

9 

Q 

What  is  the  smallest  subdivision  by 

10 

bandwidth 

of  an  optical  fiber  on  the  Internet 

11 

backbone  that  was  subjected  to  upstream 

12 

surveillance  in  June  2015  and  that  is  subjected  to 

13 

upstream  surveillance  today? 

14 

MR.  PATTON:  Objection,  compound. 

15 

Ob j  ection. 

same  as  before,  classified. 

16 

MR.  ABDO:  We  might  go  quicker  if  you 

17 

would  withdraw  the  compound  objection. 

18 

MR.  GILLIGAN:  I  like  this  pace. 

19 

actually . 

20 

BY  MR.  ABDO: 

21 

Q 

Let  me  rephrase  the  question. 

22 

What  is  the  smallest  subdivision  by 
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bandwidth  of  an  optical  fiber  on  the  Internet 
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2 

backbone  subjected  to  upstream  surveillance  today? 

3 

MR.  PATTON:  Same  objection,  same 

4 

instruction . 

5 

THE  WITNESS:  Eollowing  instruction. 

6 

BY  MR.  ABDO: 

7 

Q  What  was  the  smallest  subdivision  by 

8 

bandwidth  of  an  optical  fiber  on  the  Internet 

9 

backbone  subjected  to  upstream  surveillance  in 

10 

June  2015? 

11 

MR.  PATTON:  Same  instruction,  same 

12 

instruction . 

13 

THE  WITNESS:  Eollowing  instruction. 

14 

BY  MR.  ABDO: 

15 

Q  What  was  the  largest  circuit  by 

16 

bandwidth  on  the  Internet  backbone  subjected  to 

17 

upstream  surveillance  in  June  2015? 

18 

MR.  PATTON:  Same  objection,  same 

19 

instruction . 

20 

THE  WITNESS:  Eollowing  instruction. 

21 

BY  MR.  ABDO: 

22 

Q  What  is  the  largest  circuit  by 
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bandwidth 

on  the  Internet  backbone  subjected  to 
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2 

upstream 

surveillance  today? 

3 

MR.  PATTON:  Same  objection,  same 

4 

instruction . 

5 

THE  WITNESS:  Eollowing  instruction. 

6 

BY  MR.  ABDO: 

7 

Q 

Is  now  a  good  time  for  you  to  break. 

8 

Ms.  Richards? 

9 

A 

Sure  . 

10 

Q 

Okay,  why  don't  we  take  a  lunch  break 

11 

and  go  off  the  record.  Dawn. 

12 

(Lunch  break  taken  at  12:59  p.m.) 

13 

(Resume  at  2:06  p.m.) 

14 

BY  MR.  ABDO: 

15 

Q 

We're  back  from  lunch. 

16 

Ms.  Richards,  what  does  the  term 

17 

" Internet 

link"  refer  to? 

18 

MR.  PATTON:  Objection,  vague. 

19 

THE  WITNESS:  Is  there  a  specific 

20 

place  where  you  want  me  to  look  for  "Internet 

21 

link, "  or 

are  you  looking  for  the  general 

22 

telecommunications  definition? 
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1 

BY  MR.  ABDO: 
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2 

Q 

That's  right,  the  general  definition. 

3 

A 

So  it's  similar  to  a  circuit. 

and 

4 

there's  no 

special  NSA  meaning. 

5 

Q 

So  the  NSA's  understanding  of 

that 

6 

term  is  consistent  with  the  general  understanding 

7 

of  the  term  within  the  telecommunications 

8 

industry? 

9 

A 

That  is  correct. 

10 

Q 

Okay.  What  does  the  term 

11 

"international  Internet  link"  refer  to? 

12 

MR.  PATTON:  Objection,  vague 

,  calls 

13 

for  expert 

opinion . 

14 

THE  WITNESS:  I'm  sorry. 

15 

international  -- 

16 

BY  MR.  ABDO: 

17 

Q 

International  Internet  link. 

18 

A 

Is  there,  again,  something  specific? 

19 

I'm  not  sure  of  it. 

20 

Q 

The  question  is  whether  that 

term  has 

21 

a  meaning 

to  the  NSA. 

22 

MR.  PATTON:  Just  a  second. 
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I'm  just  going  to  object  to  the  extent 

Page  155 

2 

that  any  response  might  call  for  a  classified 

3 

answer,  subject  to  state  secrets,  statutory 

4 

privileges . 

5 

If  the  witness  has  an  unclassified 

6 

answer,  she 

can  provide  it. 

7 

THE  WITNESS:  I'm  just  going  to  take  a 

8 

minute  to  make  sure  I  -- 

9 

(Witness  reviewing  document.) 

10 

So  just  for  clarification,  you're 

11 

looking  for 

the  definition  of  "international 

12 

Internet  link"  -- 

13 

BY  MR.  ABDO: 

14 

Q 

That's  right. 

15 

A 

--  as  was  originally  described  in 

16 

Judge  Bates 

'  order? 

17 

Q 

I'm  asking  for  your  understanding  of 

18 

it,  not  for 

Judge  Bates'  understanding. 

19 

A 

Okay,  I  just  want  to  make  sure. 

20 

So  I'll  say  there's  no  special  NSA 

21 

meaning . 

22 

Q 

What  is  the  meaning  of  it  though,  even 
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if  there's  not  a  special  NSA  one? 
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2 

MR.  PATTON:  Objection  to  the  extent 

3 

it  calls  for  expert  opinion,  and  to  the  extent  it 

4 

may  call  for  classified  information  and  statutory 

5 

privileges . 

6 

The  witness  can  answer  if  the  answer 

7 

is  unclassified. 

8 

Are  you  concerned  that  there's  -- 

9 

THE  WITNESS:  I'm  concerned  whether 

10 

I'm  going  into  classified.  I'm  just  trying 

11 

to  under-  --  I'm  clicking  through  my  head  as  to 

12 

what's  classified  and  what's  not  classified,  so 

13 

I'm  sorry  I'm  taking  a  little  bit  more,  and  so 

14 

maybe  -- 

15 

MR.  PATTON:  Do  you  need  to  talk  about 

16 

that? 

17 

THE  WITNESS:  Maybe  we  should  just 

18 

take  a  quick  minute,  go  off  the  record. 

19 

MR.  ABDO:  Okay. 

20 

(Off  the  record  at  2:11  p.m.) 

21 

(Resume  at  2:28  p.m.) 

22 

MR.  ABDO:  Ms.  Jaques,  do  you  mind 
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re-reading  the  last  question  asked? 
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2 

(The  reporter  read  back  the  question.) 

3 

MR.  PATTON:  Object  to  the  question  to 

4 

the  extent  it  calls  for  expert  testimony. 

5 

THE  WITNESS:  I'm  going  to  clarify  my 

6 

answer,  which  is  the  logical  definition  of  an 

7 

international  Internet  link  would  be  an  Internet 

8 

link  between  two  countries,  but  it's  not  I  think  a 

9 

well  --  it's  not  a  telecommunications  --  unlike 

10 

some  of  the  other  descriptions  that  we  provided  in 

11 

terms  of  "circuit"  or  "cable"  or  "Internet 

12 

backbone,"  this  is  not  a  commonly  understood 

13 

telecommunications  word  --  or  set  of  three  words. 

14 

I  guess. 

15 

BY  MR.  ABDO: 

16 

Q  Okay.  But  your  understanding  of  it  is 

17 

a  link  between  two  countries  essentially? 

18 

MR.  PATTON:  Same  objection. 

19 

THE  WITNESS:  Yes,  in  the  broad 

20 

context  of  those  three  words,  not  in  the  context 

21 

of  anything  specific. 

22 
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1 

BY  MR.  ABDO: 
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2 

Q  Okay.  I  want  to  go  back  for  a  moment 

3 

to  Internet  link  --  not  international  Internet 

4 

link,  just  Internet  link. 

5 

You  said,  I  believe,  and  please 

6 

correct  me  if  I'm  wrong,  that  it  is  similar  to  a 

7 

circuit.  Is  that  correct?  Am  I  characterizing 

8 

your  previous  testimony  accurately? 

9 

MR.  PATTON:  Object  to  the  extent  it 

10 

calls  for  expert  opinion. 

11 

THE  WITNESS:  Yes. 

12 

BY  MR.  ABDO: 

13 

Q  When  you  say  "similar"  --  or  when  you 

14 

said  "similar,"  did  you  mean  analogous  to,  or  did 

15 

you  mean  identical  to?  I'm  trying  to  understand. 

16 

if  there  are  differences  between  an  Internet  link 

17 

and  a  circuit,  what  you  believe  those  differences 

18 

to  be . 

19 

MR.  PATTON:  Same  objection. 

20 

THE  WITNESS:  I  don't  see  them  —  I 

21 

see  them  as  being  analogous.  So  sometimes  you  use 

22 

"circuit,"  sometimes  you  use  "link."  I  don't  see 
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them  as  having  any  real  difference  between  them. 
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2 

BY  MR.  ABDO: 

3 

Q  Okay.  Would  "interchangeable"  be  a 

4 

better  word  than  "analogous"  then? 

5 

A  Yeah. 

6 

MR.  ABDO:  Ms.  Jaques,  would  you  mind 

7 

marking  this  Exhibit  45? 

8 

(Deposition  Exhibit  45  was 

9 

marked  for  identification.) 

10 

BY  MR.  ABDO: 

11 

Q  Ms.  Richards,  you  have  in  front  of  you 

12 

what's  been  marked  as  Exhibit  45. 

13 

Do  you  recognize  that  document? 

14 

A  I  do . 

15 

Q  What  is  it?  I  should  say,  sorry,  it's 

16 

marked  Exhibit  45,  and  it  is  Bates  numbered 

17 

NSA-WIKI  149  to  NSA-WIKI  229.  Wiki  is  spelled 

18 

W-I-K-I.  What  is  this  document,  Ms.  Richards? 

19 

A  This  is  the  Judge  Bates'  Memorandum 

20 

Opinion  from  October  3rd,  2011. 

21 

Q  Could  you  turn  to  page  45,  or 

22 

NSA-WIKI  193  of  Exhibit  45,  and  read  the  sentence 
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1 

that  begins,  "Indeed,  the  government  readily 

Page  160 

2 

concedes."  It  is  about  halfway  down  the  page. 

3 

A  Got  it. 

4 

Q  "Indeed,  the  government  readily 

5 

concedes  that  NSA  will  acquire  a  wholly  domestic 

6 

'about'  communication  if  the  transaction 

7 

containing  the  communication  is  routed  through  an 

8 

international  Internet  link  being  monitored  by  NSA 

9 

or  is  routed  through  a  foreign  server." 

10 

Is  that  sentence  true? 

11 

Let  me  rephrase  that.  Was  that 

12 

sentence  true  at  the  time  Judge  Bates  issued  this 

13 

opinion? 

14 

MR.  PATTON:  Just  a  moment. 

15 

You  can  answer. 

16 

THE  WITNESS:  Okay.  Yes,  that 

17 

sentence  is  accurate. 

18 

BY  MR.  ABDO: 

19 

Q  What  do  you  understand  the  Eoreign 

20 

Intelligence  Surveillance  Court  to  mean  in  its  use 

21 

of  the  term  "international  Internet  link"  in  that 

22 

sentence? 
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MR.  PATTON:  Objection,  the  question 

Page  161 

2 

calls  for  classified  information,  information 

3 

subject  to  the  state  secrets  and  the  statutory 

4 

privileges  previously  mentioned. 

5 

I  instruct  the  witness  not  to  answer 

6 

the  question. 

7 

BY  MR.  ABDO: 

8 

Q  Do  you  -- 

9 

A  Hold  on. 

10 

MR.  PATTON:  Do  you  have  an 

11 

unclassified  response? 

12 

THE  WITNESS:  I  have  an  unclassified 

13 

response,  at  least  in  part. 

14 

MR.  PATTON:  So  long  as  you're 

15 

comfortable  and  it's  unclassified. 

16 

THE  WITNESS:  NSA  —  so  unlike  the 

17 

other  words  that  you  had  me  go  through  in  terms  of 

18 

definitions  that  were  telecom  provider  --  you 

19 

know,  sort  of  generally  what  a  teleco  expert  would 

20 

be,  NSA  has  an  understanding  of  this  term  that  is 

21 

specific  to  how  Judge  Bates  described  it,  but  it's 

22 

classified  to  provide  any  further  information. 
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1 

BY  MR.  ABDO: 
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2 

Q  I  understand.  Is  the  NSA's 

3 

understanding  of  the  term  different  from  the 

4 

general  meaning  of  the  term  you  described  in 

5 

response  to  an  earlier  question  as  a  link  between 

6 

two  countries? 

7 

MR.  PATTON:  Objection,  calls  for 

8 

information  subject  to  the  statutory  privilege. 

9 

and  instruct  the  witness  not  to  answer  the 

10 

question . 

11 

THE  WITNESS:  I  will  follow 

12 

instructions . 

13 

BY  MR.  ABDO: 

14 

Q  Is  it  your  understanding  that  in  using 

15 

the  term  "international  Internet  link, "  the 

16 

Eoreign  Intelligence  Surveillance  Court  meant  an 

17 

Internet  link  that  terminates  in  a  foreign 

18 

country? 

19 

MR.  PATTON:  Same  objection,  same 

20 

instruction . 

21 

THE  WITNESS:  Eollowing  instruction. 

22 
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BY  MR.  ABDO: 

Page  163 

2 

Q  Is  it  your  understanding  that  an 

3 

international  Internet  link  is  an  Internet 

4 

backbone  circuit  with  one  end  in  the  United  States 

5 

and  the  other  end  in  a  foreign  country? 

6 

MR.  PATTON:  Same  objection,  same 

7 

instruction . 

8 

THE  WITNESS:  Eollowing  instruction. 

9 

BY  MR.  ABDO: 

10 

Q  Is  there  anything  you  can  tell  us 

11 

unclassified  about  the  nature  of  the  harm  that 

12 

would  arise  were  you  to  provide  an  answer  to  the 

13 

question  of  what  the  term  "international  Internet 

14 

link"  means  as  used  by  the  Eoreign  Intelligence 

15 

Surveillance  Court  in  Exhibit  45? 

16 

MR.  PATTON:  Object  to  the  question. 

17 

The  witness  is  not  an  official  classification 

18 

authority,  nor  is  she  the  Director  of  the  NSA  or 

19 

the  Director  of  National  Intelligence,  who  would 

20 

invoke  and  assert  the  state  secrets  privilege  to 

21 

that . 

22 

You  can  answer  the  question  to  the 
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extent  it's  unclassified. 
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2 

THE  WITNESS:  Sources  and  methods. 

3 

BY  MR.  ABDO: 

4 

Q  Do  you  believe  that  disclosing  the 

5 

NSA's  understanding  of  that  term  would  harm 

6 

national  security? 

7 

MR.  PATTON:  Same  objection,  same 

8 

instruction . 

9 

THE  WITNESS:  Which  was  to  not  answer. 

10 

or  to  answer  to  the  extent  -- 

11 

MR.  PATTON:  To  answer  to  the  extent 

12 

that  you're  able.  You're  not  a  classification 

13 

authority,  you're  not  asserting  the  state  secrets. 

14 

THE  WITNESS:  So  the  question  is 

15 

whether  I  believe  it  would  harm  national  security? 

16 

BY  MR.  ABDO: 

17 

Q  Yes . 

18 

A  Yes . 

19 

Q  Do  you  believe  it  would  substantially 

20 

harm  national  security? 

21 

MR.  PATTON:  Same  objection,  same 

22 

instruction . 

TransPerfect  Legal  Solutions 
212-400-8845  -  Depo@TransPerfect.com 


(aEEaas]lffi5mx/aM33B^-nsaE  DanmmTOittJBB.^  fftItetlISfflaSfflaB  W^ZEBaHmm 


1 

THE  WITNESS:  Yes. 

Page  165 

2 

BY  MR.  ABDO: 

3 

Q  Are  you  familiar  with  the  process 

4 

through  which  the  government  seeks  approval  from 

5 

the  Eoreign  Intelligence  Surveillance  Court  to 

6 

conduct  upstream  surveillance? 

7 

MR.  PATTON:  Object  to  the  form  of 

8 

that  question  as  vague,  and  objection,  beyond  the 

9 

scope  of  30  (b)  (6)  . 

10 

THE  WITNESS:  Yes. 

11 

BY  MR.  ABDO: 

12 

Q  Does  the  NSA  provide  information  to 

13 

the  Eoreign  Intelligence  Surveillance  Court  about 

14 

the  operation  of  upstream  surveillance  in  support 

15 

of  the  government's  applications  to  that  court  to 

16 

conduct  upstream  surveillance? 

17 

MR.  PATTON:  Same  objections. 

18 

THE  WITNESS:  Yes. 

19 

BY  MR.  ABDO: 

20 

Q  Is  the  information  that  the  NSA 

21 

provides  in  support  of  the  government's 

22 

applications  to  the  Eoreign  Intelligence 
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1 

Surveillance  Court  supposed  to  be  accurate? 

Page  166 

2 

MR.  PATTON:  Objection.  Same 

3 

ob j  ections . 

4 

THE  WITNESS:  Yes. 

5 

BY  MR.  ABDO: 

6 

Q  Is  that  information,  in  fact. 

7 

accurate? 

8 

MR.  PATTON:  Objection,  calls  for 

9 

speculation . 

10 

THE  WITNESS:  To  the  extent  the 

11 

government's  job  is  to  provide  the  Court  with  as 

12 

accurate  as  information  as  possible  at  the  time. 

13 

that  is  what  the  NSA  does. 

14 

BY  MR.  ABDO: 

15 

Q  Does  the  NSA  verify,  under  penalty  of 

16 

perjury,  that  its  submissions  to  the  Eoreign 

17 

Intelligence  Surveillance  Court  are  true  and 

18 

correct? 

19 

MR.  PATTON:  Same  objections. 

20 

THE  WITNESS:  Yes. 

21 

BY  MR.  ABDO: 

22 

Q  Does  the  NSA  review  the  Department  of 
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1 

Justice's  submissions  to  the  Foreign  Intelligence 

Page  167 

2 

Surveillance  Court  seeking  authority  to  conduct 

3 

upstream  surveillance? 

4 

MR.  PATTON:  Same  objections. 

5 

THE  WITNESS:  Yes. 

6 

BY  MR.  ABDO: 

7 

Q  Does  it  review  the  technical 

8 

explanations  of  the  way  that  upstream  surveillance 

9 

operates  and  drafts  of  those  submissions  before 

10 

they  are  filed  with  the  Foreign  Intelligence 

11 

Surveillance  Court? 

12 

MR.  PATTON:  Same  objections. 

13 

MR.  PADGETT:  Excuse  me,  could  you 

14 

read  back  the  question? 

15 

(The  reporter  read  back  the  record.) 

16 

THE  WITNESS:  Okay,  yes. 

17 

BY  MR.  ABDO: 

18 

Q  If  there  are  mistakes  in  the  drafts  of 

19 

the  Department  of  Justice's  submissions  to  the 

20 

Foreign  Intelligence  Surveillance  Court,  would  the 

21 

NSA  identify  those  mistakes  to  the  Department  of 

22 

Justice? 
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1 

MR.  PATTON:  Objection,  vague. 

Page  168 

2 

THE  WITNESS:  Yes. 

3 

BY  MR.  ABDO: 

4 

Q  Would  it  identify  any  inaccuracies  in 

5 

the  explanations  of  the  technical  operation  or 

6 

implementation  of  upstream  surveillance  to  the 

7 

Department  of  Justice? 

8 

A  Yes . 

9 

MR.  PATTON:  Objection,  vague  and 

10 

ambiguous,  and  also  beyond  the  scope  of  30(b) (6) . 

11 

THE  WITNESS:  Yes. 

12 

BY  MR.  ABDO: 

13 

Q  To  your  knowledge,  does  the  Eoreign 

14 

Intelligence  Surveillance  Court  acquire 

15 

information  about  the  operation  of  upstream 

16 

surveillance  from  anyone  aside  from 

17 

representatives  of  the  NSA  or  the  Department  of 

18 

Justice? 

19 

MR.  PATTON:  Objection,  calls  for 

20 

speculation.  Objection,  beyond  the  scope  of 

21 

30 (b)  (6)  . 

22 

THE  WITNESS:  What  time  frame  would 
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1 

you  be  asking  about?  Just  in  general?  Over  a 

Page  169 

2 

specific  time  frame? 

3 

BY  MR.  ABDO: 

4 

Q  Why  don't  we  --  if  you  can  answer  in 

5 

general,  please  do.  If  you  can't,  let  me  know. 

6 

MR.  PATTON:  Are  you  asking  -- 

7 

I'm  sorry,  does  this  include  just  Upstream? 

8 

MR.  ABDO:  Just  Upstream. 

9 

MR.  PATTON:  Same  objections. 

10 

THE  WITNESS:  To  the  extent  that  the 

11 

new  law  that  was  passed,  and  actually  some 

12 

previous  ones  over  the  last  couple  years,  allow 

13 

for  an  Amicus,  there's  certainly  that  opportunity 

14 

for  the  Court  to  include  that  type  of  additional 

15 

expert  outside  advice.  Similarly  --  yeah. 

16 

BY  MR.  ABDO: 

17 

Q  The  new  law  you're  referring  to  is  the 

18 

USA  Ereedom  Act? 

19 

A  Yes.  I'm  sorry,  yes,  USA  Ereedom  Act, 

20 

and  then  the  -- 

21 

Q  The  reauthorization  -- 

22 

A  --  reauthorization  for  702  also  has 
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the  Amicus  portion  of  it. 

Page  170 

2 

Q  Is  there  anyone  else,  to  your 

3 

knowledge,  from  whom  the  Foreign  Intelligence 

4 

Surveillance  Court  might  acquire  information  about 

5 

the  operation  of  upstream  surveillance? 

6 

MR.  PATTON:  Same.  Hold  on. 

7 

(Counsel  conferring.) 

8 

MR.  PATTON:  So  same  objections  as 

9 

before.  There  are,  as  you  know,  some  ex  parte 

10 

communications,  and  while  I'm  a  Department  of 

11 

Justice  Civil  Division  attorney,  I'm  not  a 

12 

Department  of  Justice  national  Security  Division 

13 

attorney,  and  so  there  may  be  other  things  that 

14 

the  witness  is  not  aware  of. 

15 

Again,  I'd  objected  before  to  the  fact 

16 

that  the  it  was  beyond  the  scope  of  30  (b)  (6) ,  so 

17 

she  may  not  be  aware  of  certain  other  things  that 

18 

may  go  on  that  I'm  not  aware  of  as  well.  I  don't 

19 

want  the  record  to  be  unclear.  That's  potentially 

20 

beyond  her  personal  knowledge. 

21 

MR.  ABDO:  Understood.  To  the  extent 

22 

you  know  the  answer  -- 
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THE  WITNESS:  So  his  answer  was 

Page  171 

2 

exactly  what  I  was  about  to  say  before  we  -- 

3 

before  my  lawyer  said  that,  which  is  fantastic,  so 

4 

I've  given  you  the  information  I  know. 

5 

I  don't  work  for  the  EISC,  I  don't  do 

6 

anything  before  the  EISC,  so  what  the  EISC  --  what 

7 

else  the  EISC  has  at  their  disposal  is  up  to  the 

8 

EISC. 

9 

BY  MR.  ABDO: 

10 

Q  Do  you  know  whether  the  NSA  reviews  or 

11 

participates  in  any  review  of  opinions  of  the 

12 

Eoreign  Intelligence  Surveillance  Court  concerning 

13 

upstream  surveillance  before  those  opinions  are 

14 

signed  or  issued? 

15 

MR.  PATTON:  Just  a  moment. 

16 

(Counsel  conferring.) 

17 

MR.  PATTON:  Would  you  just  read  that 

18 

back?  I  think  it's  fine,  but  I  just  want  to  be 

19 

double  sure . 

20 

(The  reporter  read  back  the  question.) 

21 

MR.  PATTON:  Object  as  beyond  the 

22 

scope  of  30 (b) (6) ,  but  if  you  have  personal 
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knowledge,  you  can  give  it. 

Page  172 

2 

THE  WITNESS:  To  the  best  of  my 

3 

knowledge,  no. 

4 

BY  MR.  ABDO: 

5 

Q  If  the  NSA  identifies  an  inaccuracy  in 

6 

an  opinion  of  the  Eoreign  Intelligence 

7 

Surveillance  Court  concerning  upstream 

8 

surveillance  after  that  opinion  is  issued,  would 

9 

the  NSA  notify  the  Eoreign  Intelligence 

10 

Surveillance  Court  of  that  inaccuracy? 

11 

MR.  PATTON:  Objection.  Same  as 

12 

before,  beyond  the  scope  of  30(b)  (6)  . 

13 

You  can  answer  if  you  know. 

14 

THE  WITNESS:  I  think  that's  when  you 

15 

would  go  to  the  EISC  Review  Board.  You  would  do 

16 

an  appeal. 

17 

BY  MR.  ABDO: 

18 

Q  What  if  it  were  not  a  judgment  that 

19 

the  Department  of  Justice  or  the  NSA  disagreed 

20 

with,  but  a  factual  misstatement  in  the  opinion 

21 

that  would  not  give  rise  to  or  necessitate  an 

22 

appeal ? 
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MR.  PATTON:  Same  objection. 

Page  173 

2 

THE  WITNESS:  It  would  be  fact 

3 

specific.  I  can't  speak  to  one  way  or  another. 

4 

BY  MR.  ABDO: 

5 

Q  Okay.  Do  you  imagine  that  it  would  be 

6 

good  practice  for  the  NSA  to  correct  factual 

7 

misstatements  in  the  Eoreign  Intelligence 

8 

Surveillance  Court's  opinions  if  and  when  they 

9 

identify  them? 

10 

MR.  PATTON:  Objection,  calls  for  a 

11 

legal  conclusion,  opinion,  speculation,  and  beyond 

12 

the  scope  of  30(b) (6) . 

13 

THE  WITNESS:  Again,  I  think  it  would 

14 

have  to  be  very  fact  specific  --  you  know,  the 

15 

sort  of  situation  and  fact  specific  would  have  to 

16 

decide  what  to  do  next,  but,  I  mean,  it's  an 

17 

Article  III  judge  signing  something.  We're  not 

18 

really  one  part  of  the  government  saying  something 

19 

to  the  other  part  of  the  government.  You  may  want 

20 

to  be  thoughtful  about  how  to  do  that. 

21 

BY  MR.  ABDO: 

22 

Q  Understood.  Are  there  any 
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1 

inaccuracies  that  you're  aware  of  relating  to  the 

Page  174 

2 

operation  of  upstream  surveillance  in  Exhibit  45, 

3 

October  3rd,  2011,  Foreign  Intelligence 

4 

Surveillance  Court  opinion? 

5 

MR.  PATTON:  Objection,  vague  as  to 

6 

time,  and  object  to  the  extent  it  calls  for 

7 

classified  information  or  statutory  privileges 

8 

information . 

9 

The  witness  can  answer  to  the  extent 

10 

unclassified . 

11 

THE  WITNESS:  So  you're  asking  if 

12 

there's  any  information  as  of  October  3rd,  2011, 

13 

that  we  believe  would  have  been  inaccurate  in 

14 

Judge  Bates '  Memorandum  and  Opinion? 

15 

BY  MR.  ABDO: 

16 

Q  Yes . 

17 

A  To  the  extent  that  there  are  certain 

18 

opinions  that  the  judge  makes  as  it  relates  to 

19 

different  aspects  of  this,  those  are  the  opinions 

20 

of  the  Court  and  not  necessarily  those  of  NSA. 

21 

To  the  extent  that  there  are  facts  in 

22 

here,  I  believe  we  stand  behind  those  facts,  as 
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they're  based  off  of  the  submission  from  June  1st 

Page  175 

2 

that  the  government  made  in  the  subsequent 

3 

submissions . 

4 

Q  Okay.  Did  the  NSA  conduct  a 

5 

declassification  review  of  Exhibit  45? 

6 

A  Yes . 

7 

Q  I  assume  that  was  a  thorough  review? 

8 

A  Yes . 

9 

Q  And  anything  that  would  disclose 

10 

classified  information,  the  NSA  would  identify  as 

11 

classified  to  the  FISC  so  as  not  to  release  it  to 

12 

the  public? 

13 

MR.  PATTON:  Just  a  second. 

14 

(Counsel  conferring.) 

15 

MR.  PATTON:  I'm  sorry,  could  you  read 

16 

that  question  back? 

17 

BY  MR.  ABDO: 

18 

Q  Let  me  rephrase  it.  That's  all  right. 

19 

Did  the  NSA  --  sorry. 

20 

If  the  NSA  identified  classified 

21 

information  --  let  me  --  sorry,  let  me  start  over. 

22 

Who  actually  disclosed  Exhibit  45  to 
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the  public? 

Page  176 

2 

MR.  PATTON:  Objection,  vague. 

3 

THE  WITNESS:  It's  a  EISC  document,  so 

4 

while  the  government  has  --  while  the  Executive 

5 

Branch  reviews  it  for  classification,  I  believe 

6 

the  EISC  issues  it,  although  I  know  that  the 

7 

documents  actually  sit  on  ODNI ' s  website. 

8 

BY  MR.  ABDO: 

9 

Q  Are  the  redactions  in  this  opinion  in 

10 

Exhibit  45  the  government's  redactions  or  the 

11 

EISC's  redactions? 

12 

A  So  the  process  is  with  all  these 

13 

documents  that  the  government  --  the  Executive 

14 

Branch  will  review  them  for  classification  and 

15 

suggest  redactions,  and  then  the  EISC  has  the 

16 

opportunity  to  say  no,  I  think  these  should  be  put 

17 

out,  and  there  was  a  conversation.  But  as  a 

18 

general  matter,  I  guess  they're  really  the  EISC's 

19 

document . 

20 

Q  Do  you  know  whether  there's  any 

21 

dispute  between  the  NSA  or  the  Department  of 

22 

Justice  with  the  EISC  relating  to  the 
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classifications  in  Exhibit  45? 

Page  177 

2 

MR.  PATTON:  Just  a  second. 

3 

(Counsel  conferring.) 

4 

MR.  PATTON:  My  colleague  was  just 

5 

getting  warm.  You  can  keep  answering  the 

6 

question . 

7 

THE  WITNESS:  Okay. 

8 

MR.  PATTON:  I  think  there's  some 

9 

confusion  back  and  forth  as  to  this  particular 

10 

document,  when  it  was  declassified,  and  then  the 

11 

standard  way  that  it's  now  under  USA  Ereedom  Act 

12 

taken  care  of. 

13 

But  this  was,  as  you  know. 

14 

declassified  prior  to  USA  Ereedom  Act,  and  so  I 

15 

want  to  make  sure  the  witness's  answers  are  both 

16 

accurate  and  reflective  of  what  occurred. 

17 

BY  MR.  ABDO: 

18 

Q  Right.  I'm  asking  specifically  about 

19 

this  opinion.  Exhibit  45. 

20 

A  And  to  which  I  don't  know.  I  was  not 

21 

working  at  NSA.  This  I  believe  was  declassified 

22 

in  2013,  and  I  was  not  working  at  NSA  at  that 
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point,  so  I 

don't  have  any  specific  knowledge  on 

Page  178 

2 

that  fact. 

3 

Q 

Is  there  somebody  at  NSA  who  would 

4 

know  the  answer  to  that  question? 

5 

A 

I  imagine  the  answer  is  that  there 

6 

wasn't  any 

disagreement,  that  this  is  the  document 

7 

that  went  out. 

8 

Q 

Just  to  confirm  though,  you  say  you 

9 

imagine  that.  Is  that  a  guess,  or  is  that  -- 

10 

A 

No,  that's  a  statement.  I  mean,  this 

11 

is  the  document  that  went  out.  If  there  were  any 

12 

disagreements,  those  were  resolved. 

13 

Q 

Okay . 

14 

A 

There's  no  further  information  that 

15 

can  be  provided  as  to  what  those  would  be  or  not 

16 

be . 

17 

Q 

Okay.  Would  the  NSA  treat  statements 

18 

in  a  FISC  opinion  as  classifiable  if  they  revealed 

19 

information 

that  the  government  considered 

20 

classified? 

21 

MR.  PATTON:  Objection  to  the 

22 

question . 

It  calls  for  the  expertise  of  an 
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original  classification  authority,  and  it's  beyond 
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2 

the  scope  of  30(b) (6) .  You  can  answer. 

3 

THE  WITNESS:  I'm  not  sure  I 

4 

understand  your  question,  so  ... 

5 

BY  MR.  ABDO: 

6 

Q  Let  me  ask  it  a  slightly  different 

7 

way . 

8 

Would  the  NSA  treat  a  statement  in  a 

9 

Else  opinion  as  classifiable  if  it  revealed 

10 

information  the  government  considered  classified 

11 

even  if  the  EISC  were  not  quoting  a  statement  made 

12 

by  an  Executive  Branch  agent? 

13 

MR.  PATTON:  Objection. 

14 

BY  MR.  ABDO: 

15 

Q  In  other  words,  if  the  EISC  were  to 

16 

make  a  factual  statement  using  its  own  words  about 

17 

the  operation  of  upstream  surveillance,  and  the 

18 

NSA  believed  that  statement  revealed  classified 

19 

information,  would  the  NSA  consider  that  statement 

20 

to  be  classifiable? 

21 

MR.  PATTON:  Same  objections. 

22 

THE  WITNESS:  Yes. 

TransPerfect  Legal  Solutions 
212-400-8845  -  Depo@TransPerfect.com 


(aEEaasILffi5gwqHBaaSg-~n^  PanmirnaaittJBB-^  fftltestJISfflaSfflaB  ff^EapsZBEBLaffMIiaB 


1 

BY  MR.  ABDO: 

Page  180 

2 

Q  Okay.  Does  the  NSA  conduct  upstream 

3 

surveillance  on  one  or  more  international  Internet 

4 

links?  I'm  looking  for  a  yes  or  no,  not  a 

5 

specific  number. 

6 

(Counsel  conferring.) 

7 

MR.  PADGETT:  Could  you  read  it  back? 

8 

(The  reporter  read  back  the  question.) 

9 

MR.  PATTON:  I  misheard,  so  object  to 

10 

that  as  seeking  classified  information,  subject  to 

11 

state  secrets  and  statutory  privileges. 

12 

Instruct  the  witness  not  to  answer  the 

13 

question . 

14 

THE  WITNESS:  I'll  follow  the  — 

15 

BY  MR.  ABDO: 

16 

Q  Did  the  NSA  conduct  upstream 

17 

surveillance  on  one  or  more  international  Internet 

18 

links  in  2015? 

19 

MR.  PATTON:  Same  objection,  same 

20 

instruction . 

21 

THE  WITNESS:  Will  follow  instruction. 

22 
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BY  MR.  ABDO: 
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2 

Q  Does  the  NSA  conduct  upstream 

3 

surveillance  today  on  more  than  one  international 

4 

Internet  links? 

5 

MR.  PATTON:  Same  objection,  same 

6 

instruction . 

7 

THE  WITNESS:  Will  follow  the 

8 

instruction . 

9 

BY  MR.  ABDO: 

10 

Q  Did  the  NSA  conduct  upstream 

11 

surveillance  on  more  than  one  international 

12 

Internet  links  in  June  of  2015? 

13 

MR.  PATTON:  Same  objection,  same 

14 

instruction . 

15 

THE  WITNESS:  Eollow  the  instruction. 

16 

BY  MR.  ABDO: 

17 

Q  What  is  the  number  or  approximate 

18 

number  of  international  Internet  links  on  which 

19 

the  NSA  conducted  upstream  surveillance  in  June  of 

20 

2015? 

21 

MR.  PATTON:  Same  objection,  same 

22 

instruction . 
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THE  WITNESS:  Will  follow  the 

Page  182 

2 

direction . 

3 

BY  MR.  ABDO: 

4 

Q  What  is  the  approximate  number  of 

5 

international  Internet  links  on  which  the  NSA 

6 

today  conducts  upstream  surveillance? 

7 

MR.  PATTON:  Same  objection,  same 

8 

instruction . 

9 

THE  WITNESS:  Will  follow  instruction. 

10 

BY  MR.  ABDO: 

11 

Q  Okay.  Is  upstream  surveillance 

12 

conducted  on  any  international  submarine  cables? 

13 

MR.  PATTON:  Same  objection,  same 

14 

instruction . 

15 

THE  WITNESS:  Will  follow 

16 

instructions . 

17 

BY  MR.  ABDO: 

18 

Q  Was  upstream  surveillance  conducted  on 

19 

any  international  submarine  cables  in  June  of 

20 

2015? 

21 

MR.  PATTON:  Same  objection,  same 

22 

instruction . 
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THE  WITNESS:  Will  follow  instruction. 
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2 

BY  MR.  ABDO: 

3 

Q 

What  is  the  number  or  approximate 

4 

number  of 

cables  on  which  the  NSA  conducted 

5 

upstream 

surveillance  in  June  2015? 

6 

MR.  PATTON:  Same  objection,  same 

7 

instruction . 

8 

THE  WITNESS:  Will  follow  instruction. 

9 

BY  MR.  ABDO: 

10 

Q 

What  is  the  number  or  approximate 

11 

number  of 

cables  on  which  the  NSA  today  conducts 

12 

upstream 

surveillance? 

13 

MR.  PATTON:  Same  objection,  same 

14 

instruction . 

15 

THE  WITNESS:  Will  follow  instruction. 

16 

BY  MR.  ABDO: 

17 

Q 

Okay.  In  the  context  of  upstream 

18 

surveillance,  can  you  tell  me  what  an 

19 

international  chokepoint  is? 

20 

MR.  PATTON:  Just  a  second. 

21 

Will  you  just  read  it  back,  please? 

22 

(The  reporter  read  back  the  question.) 
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1 

MR.  PATTON: 

Same  objection,  same 

2 

instruction . 

3 

THE  WITNESS: 

Will  follow  the 

4 

instruction . 

5 

BY  MR.  ABDO: 

6 

Q  Is  upstream  surveillance  today 

7 

conducted  at  one  or  more 

international 

8 

chokepoints  ? 

9 

MR.  PATTON: 

Same  objection,  same 

10 

instruction . 

11 

THE  WITNESS: 

Will  follow  instruction. 

12 

BY  MR.  ABDO: 

13 

Q  Was  upstream 

surveillance  in  June  2015 

14 

conducted  at  one  or  more 

international 

15 

chokepoints  ? 

16 

MR.  PATTON: 

Same  objection,  same 

17 

instruction . 

18 

THE  WITNESS: 

Will  follow  the 

19 

instruction . 

20 

BY  MR.  ABDO: 

21 

Q  What  number. 

approximate  number,  of 

22 

international  chokepoints 

was  upstream 
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surveillance  conducted  on  in  June  2015? 

Page  185 

2 

MR.  PATTON:  Same  objection,  same 

3 

instruction . 

4 

THE  WITNESS:  Will  follow  instruction. 

5 

BY  MR.  ABDO: 

6 

Q  What  number,  approximate  number,  of 

7 

international  chokepoints  is  upstream  surveillance 

8 

conducted  on  today? 

9 

MR.  PATTON:  Same  objection,  same 

10 

instruction . 

11 

THE  WITNESS:  Will  follow  instruction. 

12 

BY  MR.  ABDO: 

13 

Q  I  want  to  go  back  to  page  45  very 

14 

briefly  of  Exhibit  45,  the  sentence  we  were 

15 

talking  about  before,  the  one  that  begins. 

16 

"Indeed,  the  government  readily  concedes." 

17 

A  Yes,  okay. 

18 

Q  Is  there  a  term  --  well,  let  me 

19 

scratch  that  for  a  moment. 

20 

A  moment  ago  I  asked  you  whether  the 

21 

government  conducts  upstream  surveillance  on  one 

22 

or  more  international  Internet  links  in  2015,  then 
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I  asked  about  today. 

Page  186 

2 

Is  there  a  way  I  could  phrase  that 

3 

question  that  would  allow  you  to  respond  with  an 

4 

unclassified  response  more  fully  than  you've 

5 

responded  so  far? 

6 

MR.  PATTON:  For  any  given  time 

7 

period? 

8 

MR.  ABDO:  For  June  2015  to  today,  and 

9 

in  2011,  at  the  time  of  --  let  me  try  rephrasing 

10 

one  thing. 

11 

As  of  October  3rd,  2011,  did  the  NSA 

12 

conduct  upstream  surveillance  on  one  or  more 

13 

international  Internet  links? 

14 

MR.  PATTON:  Same  objection,  same 

15 

instruction . 

16 

BY  MR.  ABDO: 

17 

Q  Is  there  a  way  that  I  could  rephrase 

18 

that  question  to  use  a  term  other  than 

19 

"international  Internet  link"  that  would  allow  you 

20 

to  provide  an  unclassified  response? 

21 

(Counsel  conferring.) 

22 

MR.  PATTON:  We  don't  think  she  can. 
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This  is  Rodney  Patton,  counsel  for  government. 
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2 

We  don't  think  she  can  answer  that  as 

3 

to  specific  time  periods  for  anything  related  to 

4 

international  Internet  link.  There  may  be  a  more 

5 

general  statement  that  she  can  make,  but  I  feel 

6 

like  she's  probably  already  provided  that  to  you. 

7 

MR.  ABDO:  Okay. 

8 

MR.  PATTON:  Perhaps  if  we  could  go 

9 

out  and  check,  we  might  be  able  to  come  up  with  -- 

10 

MR.  ABDO:  Maybe  at  the  next  break. 

11 

You  can  add  this  to  -- 

12 

MR.  PATTON:  That's  fine. 

13 

BY  MR.  ABDO: 

14 

Q  So  back  to  page  45  very  briefly  of 

15 

Exhibit  45.  Do  you  understand  the  sentence  we've 

16 

been  discussing,  the  one  that  begins,  "Indeed,  the 

17 

government  readily  concedes,"  to  confirm  that,  as 

18 

of  October  3rd,  2011,  that  the  government  in  fact 

19 

conducted  upstream  surveillance  at  at  least  one 

20 

international  Internet  link? 

21 

MR.  PATTON:  Objection, 

22 

mischaracterizes  the  language  of  page  45  of 
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Exhibit  45. 

Page  188 

2 

BY  MR.  ABDO: 

3 

Q  You  can  answer. 

4 

A  Do  you  want  me  to  answer? 

5 

MR.  PATTON:  Not  as  it's  phrased,  no. 

6 

she  can  not  answer  that  question.  It  would  call 

7 

for  a  classified  answer. 

8 

MR.  ABDO:  I'm  sorry,  I  didn't  hear 

9 

that.  So  you're  instructing  the  witness  not  to 

10 

answer? 

11 

THE  WITNESS:  Yeah,  that's  classified. 

12 

BY  MR.  ABDO: 

13 

Q  Okay.  Do  you  understand  the  sentence 

14 

to  confirm  that  if  a  transaction  --  that  as  of 

15 

October  3rd,  2011,  the  NSA  would  in  fact  acquire  a 

16 

wholly  domestic  --  sorry,  would  in  fact  acquire  a 

17 

wholly  domestic  "about"  communication  if  the 

18 

transaction  containing  the  communication  were 

19 

routed  through  an  international  Internet  link 

20 

being  monitored  by  the  NSA? 

21 

MR.  PATTON:  Objection  as  not  exactly 

22 

what  the  language  of  the  sentence  said.  Let  me 
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1 

see  if  she 

can  answer  that  question. 

2 

To  avoid  us  having  to  go  out  to  the 

3 

SCIF  and  come  back  again,  she  can  answer  whether 

4 

or  not  the 

statement  in  this,  as  exactly  written. 

5 

is  correct 

as  of  October  3rd,  2011,  in  a  yes-or-no 

6 

answer.  I 

believe  she's  already  answered  that. 

7 

but  -- 

8 

MR.  ABDO:  I  think  you  did  already 

9 

answer  that 

this  sentence,  as  written,  is  true  as 

10 

of  October 

3rd,  2011. 

11 

MR.  PATTON:  That  she  can  answer. 

12 

MR.  ABDO:  Okay. 

13 

THE  WITNESS:  Do  you  want  me  to  say  it 

14 

again? 

15 

BY  MR.  ABDO: 

16 

Q 

Sure  . 

17 

A 

Yes,  that  sentence  is  accurate  as  of 

18 

October  3rd 

,  2011. 

19 

Q 

Okay.  Let  me  go  back  to  Exhibit  42. 

20 

A 

Which  one  is  42? 

21 

Q 

The  NSA's  Responses  and  Objections  to 

22 

Plaintiffs ' 

First  Set  of  Interrogatories. 

TransPerfect  Legal  Solutions 
212-400-8845  -  Depo@TransPerfect.com 


(aEEaasILffi5gwqHBaaSg-~n^  PanmirnaaittJBB-^  fftltestJISfflaSfflaB 


1 

I  direct  your  attention  to  page  7  to 

Page  190 

2 

8  . 

3 

A 

7  to  8,  oh,  yes. 

4 

Q 

The  paragraph  that  carries  over 

5 

between  the 

two,  which  is  labeled  "RESPONSE." 

6 

Would  you  mind  just  reading  that  to 

7 

yourself? 

8 

MR.  ABDO:  Why  don't  we  take  a  break 

9 

right  now. 

Can  we  go  off  the  record  for  a  minute? 

10 

(A  break  was  taken  at  3:06  p.m.) 

11 

(Resume  at  3:15  p.m.) 

12 

BY  MR.  ABDO: 

13 

Q 

Ms.  Richards,  have  you  had  a  chance  to 

14 

look  at  page  6  of  Exhibit  --  sorry,  page  7  to  8  of 

15 

the  carryover  paragraph  on  pages  7  to  8  of 

16 

Exhibit  42, 

the  NSA's  response  to  Interrogatory 

17 

No.  3? 

18 

A 

Yes  . 

19 

Q 

Is  there  anything  beyond  that  response 

20 

in  Exhibit 

42  that  isn't  classified  that  you  could 

21 

provide  us 

about  the  NSA's  understanding  of  the 

22 

term  "filtering  mechanism,"  both  in  June  2015  and 
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today? 

Page  191 

2 

A  Those  are  pretty  good  definitions 

3 

you've  got  right  there.  I  don't  have  anything 

4 

else  to  add. 

5 

Q  Does  that  mean  that  there  isn't 

6 

anything  unclassified  that  you  could  add  to  those 

7 

definitions  ? 

8 

A  There's  nothing  unclassified  I  can  add 

9 

to  those  descriptions. 

10 

Q  Okay.  With  respect  to  upstream 

11 

surveillance  as  it  operated  in  2015,  did  the  term 

12 

"filtering  mechanism"  include  the  use  of,  quote. 

13 

an  Internet  protocol  filter  to  ensure  that  the 

14 

person  from  whom  the  NSA  seeks  to  obtain  foreign 

15 

intelligence  information  is  located  overseas? 

16 

A  In  2015,  filtering  mechanism  would 

17 

have  --  one  of  the  examples  that  was  used  -- 

18 

I ' m  sorry . 

19 

An  example  of  a  filtering  mechanism 

20 

was  an  IP  address  --  sorry.  (Reviewing  document.) 

21 

Okay,  let  me  revise  --  I'm  sorry,  let 

22 

me  just  revise  my  answer. 
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Q 

Sure  . 

Page  192 

2 

A 

So  I  would  actually  add  from  the  Civil 

3 

Liberties 

and  Privacy  Office  Report,  which  is 

4 

Exhibit  44 

,  on  page  5,  where  we  give  an  example 

5 

that,  in  certain  circumstances,  NSA's  procedures 

6 

require  that  it  employ  an  Internet  protocol  filter 

7 

to  ensure 

that  the  target  is  located  overseas. 

8 

Q 

Does  that  mean  the  answer  to  my 

9 

question  is  yes,  that  the  filter  you  just 

10 

described 

is  part  of  the  filtering  mechanism 

11 

described 

in  the  NSA's  response  to  Interrogatory 

12 

No.  3? 

13 

A 

Yes,  and  so  I  was  correcting  the  fact 

14 

that  when 

I  said  that  was  everything  you  could  say 

15 

in  an  unclassified. 

16 

What  I'm  saying  is  I'm  correcting  the 

17 

record  to 

say  I  could  have  additionally  added  the 

18 

fact  that 

that  would  include  the  IP  --  that  could 

19 

include  -- 

could  include  -- 

20 

Q 

Could  include,  understood. 

21 

A 

--  as  an  example  of  what  the  filtering 

22 

mechanisms 

are,  so  ... 
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1 

Q  In  June  of  2015,  did  the  term 

Page  193 

2 

"filtering  mechanism"  include  the  use  of  an 

3 

Internet  protocol  filter?  I'm  trying  to 

4 

understand  "did"  versus  "could"  include. 

5 

MR.  PATTON:  Just  a  second. 

6 

(Counsel  conferring.) 

7 

MR.  PATTON:  Object  to  form,  vague. 

8 

You  can  answer. 

9 

THE  WITNESS:  Okay.  To  the  extent 

10 

that  the  information  is  classified  --  to  the 

11 

extent  that  how  this  exactly  works  is  classified. 

12 

I  use  the  term  "could"  as  one  of  the  examples  of 

13 

what  a  filtering  mechanism  is. 

14 

I  can  neither  confirm  nor  deny  exactly 

15 

what  was  happening  in  2015  as  it  relates  to  the 

16 

specificity  of  the  filtering  mechanism.  I  can 

17 

just  tell  you  that  it  could  include  that  as  an 

18 

example . 

19 

BY  MR.  ABDO: 

20 

Q  Can  you  confirm  whether  it  did  include 

21 

an  Internet  protocol  filter  as  of  the  date  of 

22 

Exhibit  44,  April  16th,  2014? 
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A 

As  is  specifically  stated  on  page  5, 

Page  194 

2 

it's  a  "could."  It's  not  a  "did." 

3 

Q 

Just  for  the  record,  could  you  tell  us 

4 

where  you're  reading  from  on  page  5? 

5 

A 

Sure.  It's  the  very  last  sentence  on 

6 

page  5  of  Exhibit  44  that  begins  with  "for 

7 

example . " 

8 

Q 

"In  certain  circumstances,  NSA's 

9 

procedures 

require  that  it  employ  an  Internet 

10 

protocol  filter  to  ensure  that  the  target  is 

11 

located  overseas." 

12 

So  in  certain  circumstances,  they're 

13 

required  to 

• 

14 

A 

Mm-hmm . 

15 

Q 

Can  you  tell  us  what  those  certain 

16 

circumstances  would  be  in  unclassified  terms? 

17 

MR.  PATTON:  No,  she  can't.  Object  to 

18 

the  question  to  the  extent  it  calls  for  classified 

19 

information 

-- 

20 

THE  WITNESS:  The  information  --  oh. 

21 

MR.  PATTON:  --  subject  to  the  state 

22 

secrets  and 

statutory  privileges,  and  instruct  the 
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witness  not  to  answer. 

Page  195 

2 

THE  WITNESS:  I'll  follow. 

3 

BY  MR.  ABDO: 

4 

Q  With  respect  to  upstream  surveillance 

5 

as  it  operated  in  2015,  did  the  term  "filtering 

6 

mechanism"  include,  quote,  the  use  of  a  screening 

7 

device  in  the  upstream  Internet  collection  process 

8 

to  acquire  only  Internet  transactions  containing 

9 

at  least  one  task  selector? 

10 

A  It  appears  you're  reading  from 

11 

something.  Could  you  just  refer  me  to  where  those 

12 

words  exactly  are  to  make  sure  I  have  the  full 

13 

context? 

14 

Q  Sure.  The  last  portion  of  my  question 

15 

was  a  direct  quote  from  the  NSA's  response  to 

16 

Interrogatory  No.  5  in  Exhibit  42  on  page  10,  the 

17 

text  marked  "RESPONSE." 

18 

A  Okay.  And  so  could  you  read  your 

19 

question  once  more? 

20 

Q  With  respect  to  upstream  surveillance 

21 

as  it  operated  in  2015,  did  the  term  "filtering 

22 

mechanism"  include,  quote,  the  use  of  a  screening 
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device  in  the  upstream  Internet  collection  process 

Page  196 

2 

to  acquire  only  Internet  transactions  containing 

3 

at  least  one  task  selector? 

4 

A  Sol  would  look  at  Interrogatory  4 .  I 

5 

understand  you  pointed  me  to  the  response  to 

6 

Interrogatory  5,  but  the  process  is  we  filter  for 

7 

wholly  domestic  communications,  and  then  we  do  the 

8 

scanning  to  ensure  that  we're  only  --  we're  doing 

9 

a  scan  using  a  screening  device  designed  to 

10 

identify  for  acquisition  Internet  transactions. 

11 

And  in  2015,  it  would  have  been  to. 

12 

from,  or  about  persons  targeted;  today,  it's  to  or 

13 

from  persons  targeted,  in  parens,  with  our 

14 

targeting  procedures. 

15 

Q  Okay.  What  I'm  trying  to  understand 

16 

is  whether  the  use  of  a  screening  device  is  part 

17 

of  the  filtering  mechanism  process  described  in 

18 

NSA's  response  to  Interrogatory  3? 

19 

MR.  PATTON:  Objection,  calls  for 

20 

information  that's  classified,  subject  to  state 

21 

secrets  and  statutory  privileges. 

22 

Instruct  the  witness  not  to  answer. 
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THE  WITNESS:  Eollow  instruction. 

Page  197 

2 

BY  MR.  ABDO: 

3 

Q  Would  you  be  able  to  answer  the 

4 

question  if  I  asked  whether  the  use  of  a  screening 

5 

device  could  be  part  of  the  filtering  mechanism 

6 

described  in  the  NSA's  response  to  Interrogatory  3 

7 

on  pages  7  to  8  of  Exhibit  42? 

8 

MR.  PATTON:  Just  a  second. 

9 

Can  you  read  back  that  question? 

10 

BY  MR.  ABDO: 

11 

Q  Let  me  state  it  more  clearly  because 

12 

that's  a  bit  fragmentary. 

13 

With  respect  to  upstream  surveillance 

14 

as  it  operated  in  2015,  could  the  term  "filtering 

15 

mechanism"  include,  quote,  the  use  of  a  screening 

16 

device  in  the  upstream  Internet  collection  process 

17 

to  acquire  only  Internet  transactions  containing 

18 

at  least  one  task  selector? 

19 

MR.  PADGETT:  I'm  sorry,  I  need  to 

20 

hear  that  one  more  time. 

21 

(The  reporter  read  back  the  question.) 

22 

MR.  PADGETT:  I  guess  I  would  ask. 
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before  we  instruct  the  witness  whether  they  can 

Page  198 

2 

answer  or  not,  are  you  referring  to  filtering 

3 

mechanism  as  used  in  the  document  that's  referred 

4 

to  by  Interrogatory  No.  3? 

5 

MR.  ABDO:  Yes. 

6 

MR.  PADGETT:  So  can  we  see? 

7 

MR.  ABDO:  It's  one  of  your  briefs 

8 

from  the  Fourth  Circuit. 

9 

MR.  PATTON:  Let's  go  off  the  record. 

10 

(Off  the  record  at  3:26  p.m.) 

11 

(Resume  at  3:38  p.m.) 

12 

(The  reporter  read  back  the  question.) 

13 

MR.  PATTON:  Objection,  vague. 

14 

You  can  answer. 

15 

THE  WITNESS:  Okay.  So  I  think  the 

16 

best  description  for  how  the  process  works  in  the 

17 

unclassified  realm  is  going  to  be  on  page  37  of 

18 

the  PCLOB  Report,  which  is  Exhibit  43. 

19 

To  the  extent  that  the  --  so  where  it 

20 

says  --  the  sentence  starting,  "The  provider  is 

21 

compelled  to  assist  the  government  in  acquiring 

22 

communications  across  these  circuits,  to  identify 
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and  acquire  Internet  transactions  associated  with 

Page  199 

2 

the  Section  702  task  selectors  on  the  Internet 

3 

backbone.  Internet  transactions  are  first 

4 

filtered  to  eliminate  potential  domestic 

5 

transactions,  and  then  are  screened  to  capture 

6 

only  transactions  containing  a  task  selector." 

7 

Now,  my  understanding  is  that  there's 

8 

this  other  brief  that  comes  up  with  a  new  term 

9 

called  "filtering  mechanisms";  that's  not  meant  to 

10 

be  something  special  or  otherwise  different  from 

11 

the  process  that  was  described  in  PCLOB. 

12 

To  the  extent  that  you  have  specifics 

13 

about  the  how  and  the  when  and  the  what,  that 

14 

would  be  classified,  but  those  were  not  designed 

15 

to  be  somehow  describing  something  different. 

16 

BY  MR.  ABDO: 

17 

Q  Okay.  And  for  the  record,  you're 

18 

reading  from  the  top  of  page  37  of  Exhibit  43, 

19 

correct? 

20 

A  That  is  correct. 

21 

Q  The  sentence  beginning,  "To  identify 

22 

and  acquire"? 
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A  That  is  correct. 

Page  200 

2 

Q  So  would  the  use  of  an  IP  filter  fall 

3 

within  the  description  of  that  sentence  in  which 

4 

it  says,  "Internet  transactions  are  first  filtered 

5 

to  eliminate  potential  domestic  transactions"?  Is 

6 

that  where  an  IP  filter  could  be  used? 

7 

A  Yes,  that  is  an  example  of  where  --  an 

8 

IP  filter  is  an  example  of  something  that  could  be 

9 

used  to  do  that  filter. 

10 

Q  Okay.  And  is  the  use  of  a  screening 

11 

device  described  in  the  NSA's  response  to 

12 

Interrogatory  5  in  Exhibit  42,  is  that  use  of  a 

13 

screening  device  what  could  be  used  to  accomplish 

14 

what  is  described  in  the  second  portion  of  the 

15 

sentence  that  you  were  reading  from  page  37  of 

16 

Exhibit  43,  that  second  part  saying,  quote,  then 

17 

our  screened  capture  only  transactions  containing 

18 

a  task  selector? 

19 

A  Yes . 

20 

Q  Okay.  And  with  respect  to  upstream 

21 

surveillance  as  it  operated  in  2015,  what  else 

22 

could  the  term  --  sorry,  what  else  --  what  other 
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processes  could  be  used  to  accomplish  either  the 

Page  201 

2 

filtering  or  the  screening  described  in  the 

3 

sentence  you  were  reading  from  page  37  of 

4 

Exhibit  43? 

5 

MR.  PATTON:  Objection,  calls  for 

6 

classified  information,  information  subject  to  the 

7 

statutory  privileges. 

8 

Instruct  the  witness  not  to  answer. 

9 

THE  WITNESS:  I  will  follow  the 

10 

instructions . 

11 

BY  MR.  ABDO: 

12 

Q  Okay.  Are  all  transactions  that  were 

13 

subject  to  upstream  surveillance  in  June  2015 

14 

subjected  to  Internet  protocol  filtering  -- 

15 

MR.  PATTON:  Objection. 

16 

BY  MR.  ABDO: 

17 

Q  Sorry,  let  me  just  finish  the  question 

18 

real  quick. 

19 

--  to  eliminate  potential  domestic 

20 

transactions  from  upstream  surveillance? 

21 

MR.  PATTON:  Objection,  calls  for 

22 

classified  information,  information  subject  to  the 
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statutory  privileges. 

Page  202 

2 

Instruction  not  to  answer  the 

3 

question . 

4 

THE  WITNESS:  I  will  follow  the 

5 

instructions . 

6 

BY  MR.  ABDO: 

7 

Q  Can  you  please  describe  all  the  ways 

8 

in  which  the  NSA  could  determine  in  2015  or  could 

9 

determine  today  whether  a  transaction  is  wholly 

10 

domestic  in  order  to  filter  it  out  from  upstream 

11 

surveillance? 

12 

MR.  PATTON:  Just  a  moment. 

13 

(Counsel  conferring.) 

14 

MR.  PATTON:  Could  you  break  that  down 

15 

into  2015  to  2017  to  make  it  clear? 

16 

BY  MR.  ABDO: 

17 

Q  Could  you  please  describe  all  the  ways 

18 

in  which  the  NSA  could  determine  in  2015,  as  part 

19 

of  upstream  surveillance,  whether  a  transaction  is 

20 

wholly  domestic  so  as  to  filter  it  out? 

21 

MR.  PATTON:  Objection,  calls  for 

22 

classified  information  in  order  to  respond  fully 
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to  that  question. 

Page  203 

2 

There  may  be  an  unclassified  response 

3 

to  that  question,  but  without  knowing  what  the 

4 

witness ' s 

answer  would  be,  I'm  not  comfortable 

5 

just  turning  that  over  to  her,  but  I  believe  there 

6 

is  an  unclassified  response,  but  it's  also  one 

7 

that  she  has  given  you  already. 

8 

BY  MR.  ABDO: 

9 

Q 

Okay.  If  there's  nothing  more  that 

10 

you  could 

say  that's  unclassified,  let  me  know 

11 

that  you'll  follow  your  counsel's  instruction  not 

12 

to  provide 

any  further  information. 

13 

A 

There's  no  additional  information  that 

14 

can  be  provided.  What  you  see  here  is  as  much 

15 

unclassified  information  as  available. 

16 

Q 

And  by  "here,"  you're  referring  to 

17 

Exhibit  43 

,  page  37? 

18 

A 

Page  37,  or  the  interrogatories. 

19 

Q 

The  responses  we've  been  discussing? 

20 

A 

The  responses,  yeah.  There's  no 

21 

additional 

information  to  be  provided. 

22 

Q 

Okay.  What  does  it  mean  to  say,  as 
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the  NSA's  response  to  Interrogatory  3  does,  that 

Page  204 

2 

wholly  domestic  Internet  transactions  are,  quote. 

3 

eliminated?  And  that's  in  Exhibit  42,  I  think  at 

4 

page  7  to  8 . 

5 

MR.  PATTON:  Object  to  the  extent  it 

6 

calls  for  classified  information  and  information 

7 

protected  by  the  statutory  privileges. 

8 

There  is  an  unclassified  answer  that 

9 

the  witness  can  give. 

10 

THE  WITNESS:  So  you're  asking  what 

11 

does  it  mean  to  eliminate? 

12 

BY  MR.  ABDO: 

13 

Q  Yes . 

14 

A  So  I  think  if  you  look  at  the 

15 

response,  it's  important  to  understand  that  it 

16 

starts  with  --  the  sentence  is  that  the  devices 

17 

utilized  in  the  upstream  Internet  collection 

18 

process  that  were  designed  to  eliminate  wholly 

19 

domestic  transactions . 

20 

So  they  were  --  it's  important  to 

21 

recognize  it  was  designed,  not  that  it  was 

22 

actually  done. 
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Q 

Understood.  So  let  me  then  be  clear. 

Page  205 

2 

What  does  it  mean  to  say  --  what  were 

3 

they  designed  to  do  in  eliminating  wholly 

4 

domestic  -- 

5 

A 

So  that  they  wouldn't  -- 

6 

Q 

--  transactions? 

7 

MR.  PATTON:  Same  objection,  same 

8 

instruction 

• 

9 

THE  WITNESS:  They're  designed  so  that 

10 

they  don't 

make  it  through  to  being  ingested  by 

11 

NSA's  --  into  NSA's  repository.  That's  what  it 

12 

means  to  be 

designed  to  eliminate. 

13 

BY  MR.  ABDO: 

14 

Q 

And  the  repository  is  what  holds 

15 

communications  that  contain  a  selector  and  are  not 

16 

wholly  domestic  as  of  June  2015? 

17 

MR.  PATTON:  Object  to  the  extent  it 

18 

calls  for  classified  information  and  statutory 

19 

privileges . 

You  can  answer  to  the  extent 

20 

unclassified . 

21 

THE  WITNESS:  So  — 

22 
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1 

BY  MR.  ABDO: 

Page  206 

2 

Q 

I'm  just  trying  to  understand. 

3 

When  you  say  "ingested,"  you're 

4 

referring 

to  the  databases  or  the  places  in  which 

5 

the  NSA  stores  communications  that  are  ultimately 

6 

authorized 

by  Section  702  to  collect? 

7 

A 

Yes,  yes.  It's  when  NSA  collects  it. 

8 

MR.  PATTON:  Same  objections. 

9 

THE  WITNESS:  Yes.  NSA  collects. 

10 

acquires , 

ingests.  It's  the  point  at  which  NSA 

11 

now  has  it 

• 

12 

BY  MR.  ABDO: 

13 

Q 

Understood.  Can  an  e-mail  address  be 

14 

a  selector 

under  upstream  surveillance? 

15 

A 

Yes  . 

16 

Q 

Can  a  phone  number  be  a  selector  under 

17 

upstream  surveillance? 

18 

A 

Yes . 

19 

Q 

Can  an  Internet  protocol  address  be  a 

20 

selector  under  upstream  surveillance? 

21 

MR.  PATTON:  Objection,  calls  for 

22 

classified 

information  and  privileged  information 
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1 

pursuant  to  the  statutes  aforementioned,  and 

Page  207 

2 

instruct  the  witness  not  to  answer  the  question. 

3 

THE  WITNESS:  I  will  follow  the 

4 

instructions . 

5 

BY  MR.  ABDO: 

6 

Q  Can  a  URL,  or  uniform  resource 

7 

locator,  be  a  selector  under  upstream 

8 

surveillance? 

9 

MR.  PATTON:  Same  objection,  same 

10 

instruction . 

11 

THE  WITNESS:  Will  follow  the 

12 

instruction . 

13 

MR.  PATTON:  Just  a  moment. 

14 

MR.  PADGETT:  Let's  go  off  the  record 

15 

to  discuss. 

16 

(Off  the  record  at  3:49  p.m.) 

17 

(Resume  at  3:53  p.m.) 

18 

BY  MR.  ABDO: 

19 

Q  We're  back  from  break,  and  the 

20 

question  was  can  a  URL  be  a  selector  under 

21 

upstream  surveillance? 

22 

MR.  PATTON:  Objection,  calls  for 
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classified  information  and  information  protected 

Page  208 

2 

by  the  statutory  privileges. 

3 

Instruct  the  witness  not  to  answer. 

4 

THE  WITNESS:  I  will  not  answer. 

5 

BY  MR.  ABDO: 

6 

Q  Could  a  URL  be  a  selector  under 

7 

upstream  surveillance  as  of  June  2015? 

8 

MR.  PATTON:  Same  objection,  same 

9 

instruction . 

10 

THE  WITNESS:  Will  follow  the 

11 

instruction . 

12 

BY  MR.  ABDO: 

13 

Q  Are  the  selectors  used  for  upstream 

14 

surveillance  the  same  as  those  used  for  PRISM 

15 

surveillance  as  of  June  2015? 

16 

MR.  PATTON:  Same  objection,  same 

17 

instruction . 

18 

THE  WITNESS:  Wait,  I'm  sorry.  Can 

19 

you  ask  the  question  again? 

20 

BY  MR.  ABDO: 

21 

Q  Sure.  I'll  modify  it  slightly  to  make 

22 

it  grammatically  correct. 
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1 

Were  the  selectors  used  for  upstream 

Page  209 

2 

surveillance  the  same  as  those  used  for  PRISM 

3 

surveillance  in  June  2015? 

4 

MR.  PATTON:  Same  objection,  same 

5 

instructions . 

6 

THE  WITNESS:  Can  you  just  — 

7 

MR.  ABDO:  Ms.  Jaques,  would  you  mind 

8 

marking  this  as  Exhibit  --  you're  still  looking  at 

9 

something  for  this  question? 

10 

THE  WITNESS:  Yes,  I  am. 

11 

The  only  thing  I  would  state  which  is 

12 

definitely  not  classified  is  on  page  6  of  the 

13 

Civil  Liberties  and  Privacy  Office  Report, 

14 

Exhibit  44.  At  the  very  top  of  page  6  it  says. 

15 

"The  process  for  approving  the  selectors  for 

16 

tasking  is  the  same  for  both  PRISM  and  upstream 

17 

collection . " 

18 

I  realize  that's  not  exactly  the 

19 

question  you  were  asking,  but  I  just  wanted  to 

20 

make  sure  you  had  that  piece  of  information. 

21 

BY  MR.  ABDO: 

22 

Q  Thank  you.  Ms.  Jaques,  would  you  mind 
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marking  this  46?  And  it's  the  entire  folder. 

Page  210 

2 

(Deposition  Exhibit  46  was 

3 

marked  for  identification.) 

4 

BY  MR.  ABDO: 

5 

Q 

Ms.  Richards  -- 

6 

A 

Oh,  this  is  fabulous,  okay. 

7 

Q 

You  have  in  front  of  you  what's  marked 

8 

as  Exhibit  46.  Do  you  recognize  that  document? 

9 

A 

I  do . 

10 

Q 

And  what  is  that  document? 

11 

A 

This  is  the  Privacy  and  Civil 

12 

Liberties 

Oversight  Board  Public  Hearing  Regarding 

13 

the  Surveillance  Program  Operated  Pursuant  to 

14 

Section  702  of  the  Foreign  Intelligence 

15 

Surveillance  Act,  March  19,  2014. 

16 

Q 

Did  employees  of  the  NSA  testify  at 

17 

that  hearing? 

18 

A 

Yes . 

19 

Q 

And  they  were  testifying  in  their 

20 

official 

capacity  as  NSA  employees? 

21 

A 

Yes . 

22 

Q 

Could  you  turn  to  page  57  of  the 
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transcript? 

Do  you  see  at  lines  17  to  20 

there  '  s 

Page  211 

2 

a  statement 

that's  labeled  as  coming  from 

Mr.  De, 

3 

spelled  D-E? 

4 

Do  you  understand  that  to  be 

--  who  do 

5 

you  understand  that  to  be? 

6 

A 

I'm  sorry,  we're  at  line? 

7 

Q 

Lines  17  to  20  of  page  57. 

8 

A 

17  to  20,  okay. 

9 

Q 

Of  Exhibit  46. 

10 

A 

Mr.  De .  Oh,  let  me  just  -- 

11 

Q 

Before  getting  to  the  substance  of 

12 

that  sentence,  which  we'll  give  you  a  chance  to 

13 

read  in  a  second,  do  you  know  who  this  Mr 

.  De  is 

14 

who  is  being  referred  to? 

15 

A 

Yes.  He  was  the  general  counsel  at 

16 

the  time  of 

NSA. 

17 

Q 

And  for  the  record,  his  full 

name  is 

18 

Rajesh  De? 

19 

A 

Yes  . 

20 

Q 

Could  you  now  read  those  two 

lines  -- 

21 

those  four 

lines,  17  to  20  on  page  57,  to 

22 

yourself? 
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A  (Witness  reviewing  document.)  Okay. 

Page  212 

2 

Q  What  do  you  understand  Mr.  De  to  have 

3 

been  communicating  in  this  first  sentence?  And 

4 

the  first  sentence  was,  quote,  "And  it's  the  same 

5 

selectors  that  are  used  for  the  PRISM  program  that 

6 

are  also  used  for  upstream  collection." 

7 

MR.  PATTON:  Objection  to  form,  vague. 

8 

MR.  ABDO:  You  can  answer. 

9 

THE  WITNESS:  I  think  similar  to  what 

10 

I  just  read  to  you,  the  words  on  the  face  of  it 

11 

seem  accurate. 

12 

I'm  not  sure  what  you're  trying  to  ask 

13 

me.  Maybe  you  can  help  clarify. 

14 

BY  MR.  ABDO: 

15 

Q  What  I'm  trying  to  understand  is 

16 

whether  the  selectors  that  are  used  for  PRISM  are 

17 

also  used  for  Upstream  collection,  and  that  seems 

18 

to  be  on  the  face  of  the  statement  what  Mr.  De 

19 

said  at  the  hearing  transcribed  in  Exhibit  46,  but 

20 

I  understood  you  to  refuse  to  answer  the  question 

21 

of  whether  the  selectors  that  are  used  for  the 

22 

PRISM  program  are  also  used  for  Upstream 
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collection,  so  I'm  trying  to  understand  what  the 

Page  213 

2 

difference  is  between  my  question  and  this 

3 

statement . 

4 

A  I  think  I  need  to  go  --  sorry. 

5 

MR.  PADGETT:  Can  I  ask  a  clarifying 

6 

question?  Because  it  might  involve  an 

7 

instruction . 

8 

MR.  PATTON:  Right.  There's  also  a 

9 

difference  of  what  we're  talking  about  here,  so  I 

10 

don't  know  whether  the  witness  is  aware  of  that. 

11 

the  differences. 

12 

MR.  ABDO:  Are  you  saying  you  need  to 

13 

talk  in  the  SCIF? 

14 

MR.  PATTON:  I  don't  know  that  we  need 

15 

time  to  talk  in  the  SCIF,  but  the  objection  was  to 

16 

something  A,  and  this  is  meaning  something  B,  if 

17 

you  know  what  I  mean,  and  therefore  I  want  to  get 

18 

you  that  answer  because  I  think  that  answer  is 

19 

unclassified . 

20 

MR.  ABDO:  Is  there  an  answer  that  the 

21 

witness  -- 

22 

MR.  PATTON:  Because  I  can  understand 

TransPerfect  Legal  Solutions 
212-400-8845  -  Depo@TransPerfect.com 


(aEEaasILffi5gwqHBaaSg-~n^  PanmirnaaittJBB-^  fftltestJISfflaSfflaB  ff&apsauSBaffJ^M 


1 

why  you're  having  this  question,  but  I'm  trying  to 

Page  214 

2 

figure  out  the  best  way  to  get  you  that 

3 

unclassified  answer. 

4 

BY  MR.  ABDO: 

5 

Q  Ms.  Richards,  do  you  understand  the 

6 

distinction  your  counsel  is  drawing  between  this 

7 

statement  by  Mr.  De  at  the  hearing  transcribed  in 

8 

Exhibit  46  and  the  question  that  I  asked  a  few 

9 

moments  ago  about  whether  selectors  used  for 

10 

Upstream  are  the  same  as  those  used  for  PRISM 

11 

surveillance? 

12 

If  you  know  the  answer  to  my  question. 

13 

could  you  please  answer  it? 

14 

A  So  let  me  see  if  I  can  restate  the  two 

15 

different  questions,  and  maybe  I  need  to  have  you 

16 

read  back  to  me  what  you  asked  before  and  we 

17 

objected  to  on  classified,  which  is  this  statement 

18 

states,  "it's  the  same  selectors  that  are  used  for 

19 

the  PRISM  program  that  are  also  used  for  upstream 

20 

collection . " 

21 

A  few  minutes  ago,  you  had  asked 

22 

whether  this  was  true,  and  I  declined  to  comment 
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for  classified  purposes. 

Page  215 

2 

Q  Right. 

3 

A  That's  the  -- 

4 

Q  Well,  let  me  phrase  it  this  way. 

5 

Is  the  statement  that  Mr.  De  made  at 

6 

this  hearing  in  March  of  2014  true,  or  was  it  true 

7 

at  that  time  that,  quote,  it's  the  same  selectors 

8 

that  are  used  for  the  PRISM  program  that  are  also 

9 

used  for  upstream  collection? 

10 

A  I  would  like  to  confer  in  the  SCIF 

11 

before  I  give  you  the  answer  to  both  of  those 

12 

questions . 

13 

MR.  PATTON:  I  just  want  to  seek 

14 

clarification  for  the  record. 

15 

Are  you  concerned  that  there's  a 

16 

privilege  issue,  a  classification  issue?  Is  that 

17 

your  concern? 

18 

THE  WITNESS:  Yes. 

19 

MR.  PATTON:  Okay. 

20 

THE  WITNESS:  Not  with  this  sentence. 

21 

MR.  PATTON:  Not  with  the  sentence. 

22 

but  whether  or  not  you  can  answer  -- 
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THE  WITNESS:  With  the  other  question 

Page  216 

2 

that  was  asked. 

3 

BY  MR.  ABDO: 

4 

Q  I  see.  If  I  were  to  rephrase  my 

5 

previous  question  to  be  were  the  selectors  used 

6 

for  PRISM  surveillance  in  June  2015  the  same  as 

7 

those  used  for  Upstream  surveillance? 

8 

MR.  PATTON:  I  have  to  object  to  the 

9 

question  as  to  its  vagueness.  There  is  an 

10 

unclassified  answer  and  there's  a  classified 

11 

answer,  and  -- 

12 

THE  WITNESS:  And  I'm  tripping  over 

13 

which  one,  so  I  just  need  to  go  -- 

14 

MR.  PATTON:  --  and  I  want  to  get  you 

15 

the  unclassified  answer. 

16 

MR.  ABDO:  Okay.  Can  we  take  a  break 

17 

and  go  off  the  record  while  you  guys  confer  in  the 

18 

SCIE? 

19 

(Off  the  record  at  4:03  p.m.) 

20 

(Resume  at  4:13  p.m.) 

21 

BY  MR.  ABDO: 

22 

Q  We're  back  on  the  record. 
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The  question  we  left  with. 

Page  217 

2 

Ms.  Richards,  was  what  Mr.  De  meant  in  the  hearing 

3 

in  March  2014,  transcribed  in  Exhibit  46,  when  he 

4 

said,  "And  it's  the  same  selectors  that  are  used 

5 

for  the  PRISM  program  that  are  also  used  for 

6 

upstream  collection." 

7 

MR.  PATTON:  Objection  to  the  extent 

8 

it  calls  for  classified  information  and 

9 

information  protected  by  the  statutory  privileges. 

10 

You  can  answer  to  the  extent 

11 

unclassified . 

12 

THE  WITNESS:  Okay.  So  in  looking  at 

13 

page  57,  it's  important  to  roll  back  to  roughly 

14 

around  page  55  and  understand  what  they  were 

15 

talking  about  at  this  point.  And,  specifically,  I 

16 

would  bring  you  to  --  okay,  I'm  sorry,  go  back  to 

17 

54.  Where  did  the  language  just  go?  Okay, 

18 

I'm  sorry,  page  56. 

19 

So  Mr.  Wiegmann  says,  "About  that 

20 

selector,  correct." 

21 

And  then  Mr.  De  says,  "It  is  always 

22 

focused  on  that  account,  so  I  think  the  key  is. 
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the  misperception  that  some  may  have  that  'about' 

Page  218 

2 

collection  is  somehow  about  a  key  word  or  about 

3 

the  person  that  may  be  behind  that  account. 

4 

"But  all  collections  under 

5 

Section  702,  whether  it's  upstream  abouts,  which 

6 

is  a  subset  of  upstream,  or  PRISM  is  all  based  on 

7 

the  selectors  at  issue." 

8 

Then  we  have  Ms.  Brand  says,  "Just  to 

9 

follow-up  on  that  because  that's  a  good  line  of 

10 

inquiry,  just  to  make  sure  that  everyone 

11 

understands.  So  you're  saying  that  if  someone  is 

12 

emailing  about  Rachel  Brand  or  about  explosives 

13 

that  would  not  be  a  permissible  about  query  under 

14 

your  explanation?" 

15 

And  Mr.  De  goes  on,  and  what  he's 

16 

explaining  then,  when  we  get  down  to  lines  17  to 

17 

20,  is  the  type  of  selectors  is  the  context  for 

18 

this  exchange  back  and  forth,  which  is  then 

19 

how  this  is  --  in  talking  about  the  types  of 

20 

selectors,  as  opposed  to  "bomb"  or  "explosive"  or 

21 

a  name,  he's  explaining  that  these  are  the  same 

22 

types  of  selectors. 
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That  is  what's  the  unclassified  fact. 
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2 

and  then  it's  furthered  by  the  sentence  I 

3 

mentioned  in  the  Civil  Liberties  and  Privacy 

4 

Office  Report,  as  opposed  to  your  question  you 

5 

asked  earlier  where  we  said  that's  classified. 

6 

BY  MR.  ABDO: 

7 

Q  I  think  I  understand. 

8 

A  Okay. 

9 

Q  Moving  on  a  bit. 

10 

As  of  2015,  did  the  procedures 

11 

approved  by  the  FISC  for  upstream  surveillance 

12 

permit  the  NSA  to  collect  an  international  HTTP 

13 

transmission  of  a  website  if  the  text  of  that 

14 

website  contained  a  selector? 

15 

MR.  PATTON:  Objection,  calls  for 

16 

classified  information  and  information  subject  to 

17 

the  statutory  privileges. 

18 

Instruct  not  to  answer  the  question. 

19 

THE  WITNESS:  I  will  follow  the 

20 

instruction . 

21 

BY  MR.  ABDO: 

22 

Q  Okay.  Sorry,  just  one  second. 
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(Deposition  Exhibit  47  was 

Page  220 

2 

marked  for  identification.) 

3 

BY  MR.  ABDO: 

4 

Q  Ms.  Richards,  you  have  in  front  of  you 

5 

what's  been  marked  as  Exhibit  47. 

6 

Do  you  recognize  this  document? 

7 

A  Yes . 

8 

Q  What  is  it? 

9 

A  This  is  the  government's  response  to 

10 

the  Court's  briefing  order  of  May  9th,  2011. 

11 

Q  With  the  Court  being  the  foreign 

12 

Intelligence  Surveillance  Court? 

13 

A  Yes . 

14 

Q  Do  you  know  which  agency  of  government 

15 

authored  this  document? 

16 

A  It's  submitted  by  the  National  -- 

17 

MR.  PATTON:  Objection  to  form,  vague. 

18 

THE  WITNESS:  —  National  Security 

19 

Division  of  the  Department  of  Justice,  and 

20 

verified  by  National  Security  Agency. 

21 

BY  MR.  ABDO: 

22 

Q  Okay.  When  you  say  "verified,"  you 
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mean  verified  as  to  the  accuracy  of  the  statements 

Page  221 

2 

within  it? 

3 

A  Yes,  to  the  best  of  the  knowledge  of 

4 

the  individual  doing  it. 

5 

Q  Would  you  mind  turning  to  page  30  of 

6 

Exhibit  47?  And  I  should  have  mentioned  at  the 

7 

outset.  Exhibit  47  is  Bates  stamped 

8 

NSA-WIKI  237  --  sorry,  I  may  not  have  the  full 

9 

version  in  mine.  Sorry,  NSA-WIKI  234  to  277. 

10 

Okay,  if  you  turn  to  page  30,  which  is 

11 

marked  NSA-WIKI  266,  toward  the  bottom  there's  a 

12 

sentence  that  begins  "this  figure,"  and  I'll  read 

13 

it.  "This  figure  was  then  compared  to  the  total 

14 

take  of  Section  702  upstream  collection  of  web 

15 

activity  for  the  month." 

16 

Do  you  know  the  context  in  which  this 

17 

sentence  was  written  in  unclassified  terms? 

18 

A  Can  you  clarify  your  question?  I'm 

19 

not  sure  I  know  what  you're  asking. 

20 

Q  Was  the  context  of  this  sentence  an 

21 

effort  to  respond  to  the  EISC's  inquiry  of  the  NSA 

22 

about  the  volume  of  certain  forms  of  the  NSA's 
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1 

upstream  collection? 

2 

A 

Can  you  repeat? 

3 

Q 

I'll  repeat  that. 

4 

Does  this  sentence  come  in  a  paragraph 

5 

responding 

to  the  FISC's  inquiry  of  the  NSA  about 

6 

the  volume 

of  certain  forms  of  the  NSA's  upstream 

7 

collection 

activity? 

8 

A 

Yes  . 

9 

Q 

And  was  this  sentence  explaining  how 

10 

the  Department  of  Justice  and  the  NSA  arrived  at 

11 

certain  figures  it  was  relaying  to  the  FISC  in 

12 

responding 

to  the  question? 

13 

A 

Yes  . 

14 

Q 

What  does  "web  activity"  mean  in  the 

15 

context  of 

Internet  communications? 

16 

MR.  PATTON:  Object  to  the  form  of  the 

17 

question  to 

i  the  extent  it  calls  for  a  classified 

18 

answer  or  an  answer  that  would  be  subject  to  the 

19 

statutory  privileges. 

20 

The  witness  can  answer  if  there's  an 

21 

unclassified  answer. 

22 

THE  WITNESS:  I'm  going  to  read  this 
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answer  over  once  more  before  I  give  you  -- 

Page  223 

2 

BY  MR.  ABDO: 

3 

Q  Please.  Maybe  I  can  rephrase  the 

4 

question  for  you. 

5 

A  Sure . 

6 

Q  Do  you  understand  "web  activity"  to 

7 

refer  to  activity  of  the  World  Wide  Web  --  or 

8 

activity  on  the  World  Wide  Web? 

9 

MR.  PATTON:  Just  a  second. 

10 

(Counsel  conferring.) 

11 

MR.  PATTON:  I'm  just  going  to  object 

12 

to  the  vagueness. 

13 

THE  WITNESS:  I  would  refer  that  to 

14 

meaning  as  a  way  of  generally  talking  about  the 

15 

collection  of  discrete  Internet  communications. 

16 

BY  MR.  ABDO: 

17 

Q  Would  you  understand  it  to  refer  to 

18 

collection  --  let  me  ask  this. 

19 

Would  Internet  web  browsing  constitute 

20 

web  activity? 

21 

MR.  PATTON:  Objection,  calls  for 

22 

classified  information  to  the  extent  that  it's 
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being  asked  in  the  context  of  upstream  collection 

Page  224 

2 

in  this  particular  document,  and  subject  to  that 

3 

objection  and  to  the  statutory  privileges  that 

4 

would  protect  that. 

5 

I  instruct  the  witness  not  to  answer 

6 

the  question. 

7 

THE  WITNESS:  I  will  follow  the 

8 

instruction . 

9 

BY  MR.  ABDO: 

10 

Q  Do  you  understand  the  meaning  of  the 

11 

term  "web  activity"  generally,  not  with  regard  to 

12 

this  document? 

13 

A  Yes . 

14 

MR.  PATTON:  Object.  Object  that  it's 

15 

beyond  the  scope  of  the  30 (b) (6) ,  but  the  witness 

16 

can  answer. 

17 

BY  MR.  ABDO: 

18 

Q  What  does  it  mean  generally  beyond  -- 

19 

you  know,  outside  of  the  context  of  this  document. 

20 

Exhibit  47? 

21 

MR.  PATTON:  Same  objection. 

22 

THE  WITNESS:  You  say  activity  on  the 
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Internet? 

Page  225 

2 

BY  MR.  ABDO: 

3 

Q 

Any  activity  on  the  Internet.  You 

4 

don't  understand  "web  activity"  to  be  distinct 

5 

from  "Internet  activity"? 

6 

MR.  PATTON:  Same  objection. 

7 

THE  WITNESS:  I  think  it's  a  vague 

8 

enough  term  it  could  be  meant  any  number  of 

9 

different 

things  . 

10 

BY  MR.  ABDO: 

11 

Q 

You  don't  understand  it  to  mean 

12 

specifically  the  protocol  referred  to  as  the  World 

13 

Wide  Web, 

which  encompasses  HTTP  and  HTTPS 

14 

communications?  That's  not  how  you  understand  an 

15 

Internet 

professional  would  understand  that  term? 

16 

MR.  PATTON:  Same  objection,  adding 

17 

ob j  ection 

that  it  calls  for  expert  opinion,  and 

18 

also  object  that  it's  asked  and  answered. 

19 

THE  WITNESS:  I  don't  think  there's  a 

20 

set  definition  for  "web  activity."  I  think  it 

21 

could  mean  Internet  activity,  it  could  mean  World 

22 

Wide  Web 

activity.  It  could  mean  any  of  those 
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different  --  those  particular  different  ones. 
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2 

I  think  you  have  to  look  at  the 

3 

context  for  the  sentence,  and  then  make  a  decision 

4 

accordingly . 

5 

BY  MR.  ABDO: 

6 

Q  Do  you  have  any  reason  to  believe  that 

7 

this  sentence  was  inaccurate,  "this  sentence" 

8 

again  in  Exhibit  47  beginning,  "This  figure  was 

9 

then  compared"? 

10 

A  No. 

11 

Q  Does  it  disclose  classified 

12 

information? 

13 

MR.  PATTON:  As  redacted? 

14 

MR.  ABDO:  As  it  appears  in 

15 

Exhibit  47. 

16 

THE  WITNESS:  I  don't  think  so. 

17 

BY  MR.  ABDO: 

18 

Q  To  your  knowledge,  is  the  term 

19 

"web  activity"  ever  otherwise  used  by  the  NSA  in 

20 

publicly  disclosed  documents  interchangeably  with 

21 

"Internet  activity"  at  large? 

22 

MR.  PATTON:  Object  to  the  form. 
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vague . 
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2 

THE  WITNESS:  I  don't  know  that  I've 

3 

seen  "web  activity"  used  in  other  documents  that 

4 

are  unclassified  --  that  have  been  declassified. 

5 

To  the  extent  you're  going  to  show  me  one  next  -- 

6 

BY  MR.  ABDO: 

7 

Q  I  don't  have  one.  I'm  asking. 

8 

A  So  if  this  is  the  only  instance  of 

9 

this  and  you're  --  you  know,  I  don't  have  --  I 

10 

haven't  seen  it  in  any  of  the  other  documents  I've 

11 

read  in  the  last  few  weeks,  or  since  we've  been 

12 

prepping  for  this,  so  -- 

13 

Q  I'm  not  trying  to  play  a  game  of 

14 

gotcha.  I'm  asking  because  your  answer  suggested 

15 

that  you  believe  "web  activity"  to  be  essentially 

16 

used  interchangeably  with  the  very  generic  term 

17 

"Internet  traffic"  or  "Internet  communications," 

18 

and  I  would  assume,  if  that  were  the  case,  then 

19 

the  NSA  would  in  fact  use  that  term 

20 

interchangeably,  but  I  don't  believe  that  to  be 

21 

the  case.  I'm  asking  why  that  is. 

22 

MR.  PATTON:  Object  to  the  extent  it 
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mischaracterizes  prior  testimony. 
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2 

THE  WITNESS:  I  don't  have  any 

3 

specific  further  information  that  would  help 

4 

elucidate  this  conversation. 

5 

Anything  further  I  might  say  would  go 

6 

into  a  classified  discussion,  and  so  I  can't  give 

7 

you  any  further  explanation  as  to  the  use  of  the 

8 

word  "web"  there. 

9 

BY  MR.  ABDO: 

10 

Q  Under  upstream  surveillance,  as 

11 

conducted  in  June  2015,  was  the  NSA  permitted  to 

12 

collect  the  communications  of  a  foreign  target 

13 

with  a  website  in  the  United  States? 

14 

MR.  PATTON:  Just  a  second. 

15 

(Counsel  conferring.) 

16 

MR.  PATTON:  Object  to  the  form,  vague 

17 

and  ambiguous,  and  also  object  that  it  could  call 

18 

for  classified  information  and  information 

19 

protected  by  the  statutory  privileges. 

20 

Depending  on  what  the  question  means. 

21 

there  might  be  an  unclassified  answer. 

22 
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BY  MR.  ABDO: 
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2 

Q  Do  you  have  an  unclassified  answer. 

3 

Ms.  Richards? 

4 

MR.  PATTON:  And  if  she  does,  I'd  like 

5 

to  hear  it  before  she  gives  it  to  make  sure  that 

6 

it  is  unclassified. 

7 

BY  MR.  ABDO: 

8 

Q  Let  me  give  you  another  question  to 

9 

consider . 

10 

A  I  was  just  going  to  say,  do  you  have  a 

11 

whole  bunch  of  them,  and  then  we  can  go  and  confer 

12 

on  what  those  might  be? 

13 

Q  I  have  one  other. 

14 

A  Okay,  but  could  you  repeat  that  one 

15 

again? 

16 

Q  Let  me  repeat  that  one,  and  I'll  tell 

17 

you  the  other  one. 

18 

A  Yeah. 

19 

Q  The  first  one  is,  under  upstream 

20 

surveillance  as  approved  as  of  June  2015,  was  the 

21 

NSA  permitted  to  collect  the  communications  of  a 

22 

foreign  target  --  that  is,  somebody  who  is  a 
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foreign  target  of  upstream  surveillance  --  abroad 
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2 

with  a  website  in  the  United  States? 

3 

Do  you  understand  my  question? 

4 

A 

I  do  understand. 

5 

I  don't  think  there's  an  unclassified 

6 

answer,  but 

to  the  extent  -- 

7 

Q 

Okay.  The  second  question  that  I  hope 

8 

you'll  consider  in  the  SCIF,  under  upstream 

9 

surveillance  as  it  was  implemented  in  June  2015, 

10 

was  the  NSA 

permitted  to  collect  the  transactions 

11 

or  communications  of  a  non-targeted  foreigner 

12 

abroad  with 

a  website  in  the  United  States  if  the 

13 

website  contained  a  selector  tasked  for 

14 

collection? 

15 

A 

A  non-targeted  foreigner  abroad  on  a 

16 

U.  S  .  — 

17 

Q 

With  a  website  in  the  United  States. 

18 

A 

With  a  website  in  U.S. 

19 

Q 

If  the  website  contained  a  selector 

20 

task  for  collection.  You're  generally  -- 

21 

MR.  GILLIGAN:  I'm  baffled  by  the 

22 

question . 
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MR.  ABDO:  A  non-foreign  target  --  I'm 
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2 

sorry,  a  non-targeted  foreigner  abroad 

3 

communicating  with  a  website  in  the  United  States, 

4 

and  the  website  contains  a  selector. 

5 

MR.  GILLIGAN:  You  mean  communicating 

6 

with  a  website? 

7 

MR.  ABDO:  Yeah.  They  visit  the 

8 

website,  for  example.  They're  communicating  with 

9 

a  website. 

10 

MR.  GILLIGAN:  Yeah,  that's  what  was 

11 

baffling,  what  you  meant  by  "with." 

12 

MR.  ABDO:  Communications  to  and  from. 

13 

THE  WITNESS:  So  the  selector  is 

14 

looking  at  the  website? 

15 

BY  MR.  ABDO: 

16 

Q  Suppose  a  non-targeted  foreigner 

17 

abroad  is  viewing  a  website,  and  the  website  is 

18 

stored  on  a  web  server  in  the  United  States,  and 

19 

it  contains  a  task  selector  -- 

20 

A  The  website? 

21 

Q  The  website.  And  that  task  selector 

22 

is  being  communicated  back  to  this  non-targeted 
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foreigner  abroad,  and  it  passes  through  something 
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2 

being  monitored  by  the  NSA  in  upstream 

3 

surveillance,  did  the  NSA  have  the  authority  in 

4 

2015  to  collect  that  communication? 

5 

MS.  HANLEY  COOK:  Should  we  go  off  the 

6 

record  now? 

7 

MR.  ABDO:  Okay,  thanks. 

8 

MR.  PATTON:  Thank  you. 

9 

(Off  the  record  at  4:30  p.m.) 

10 

(Resume  at  4:46  p.m.) 

11 

MR.  PATTON:  The  witness  has  reviewed 

12 

in  the  interim  the  applicable  targeting 

13 

procedures,  the  declassified  public  version  of 

14 

those,  and  is  prepared  to  make  a  statement  on  that 

15 

particular  point,  but  we  don't  believe  that 

16 

anything  beyond  what  she's  going  to  say  can  be 

17 

said  on  the  public  record. 

18 

So  to  the  extent  not  covered  by  what 

19 

she's  about  to  say,  we  object  to  the  questions  to 

20 

the  extent  they  call  for  a  classified  response 

21 

subject  to  state  secrets  and  subject  to  the 

22 

statutory  privileges. 
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THE  WITNESS:  The  examples  you 
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2 

provided  are  classified.  How  the  targeting  might 

3 

or  might  not  occur  is  all  classified  on  page  5. 

4 

It's  all  black,  so  we  can't  go  any  further  into 

5 

that  information. 

6 

If  you  would  like  to  --  I'm  sorry. 

7 

I'm  looking  at  Exhibit  A,  the  procedures  used  by 

8 

the  National  Security  Agency  for  targeting 

9 

non-United  States  persons  reasonably  believed  to 

10 

be  located  outside  the  United  States  to  acquire 

11 

foreign  intelligence  information  pursuant  to 

12 

Section  702  of  the  Eoreign  Intelligence 

13 

Surveillance  Act  of  1978  as  amended.  These  are 

14 

dated  June  2014. 

15 

BY  MR.  ABDO: 

16 

Q  What  page  were  you  looking  at  of 

17 

those? 

18 

A  5 . 

19 

Q  If  I  understand,  page  5  relates  to  the 

20 

NSA's  method  for  assessing  whether  there  would  be 

21 

a  foreign  intelligence  purpose  for  collecting 

22 

certain  Internet  communications,  right? 
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A  Yes . 
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2 

Q  My  question  didn't  deal  with  whether 

3 

the  NSA  in  fact  had  reason  to  or  would  want  to 

4 

collect  Internet  communications. 

5 

My  question  was,  did  the  NSA,  in  June 

6 

of  2015,  have  the  authority  to  collect  the 

7 

communications  of  a  foreign  target  abroad  with  a 

8 

website  in  the  United  States? 

9 

MR.  PATTON:  The  answer  to  that 

10 

question  is  classified  and  subject  to  statutory 

11 

privileges . 

12 

Instruct  the  witness  not  to  answer  the 

13 

question . 

14 

THE  WITNESS:  I'll  follow  the 

15 

instructions . 

16 

BY  MR.  ABDO: 

17 

Q  And  under  upstream  surveillance  as 

18 

conducted  in  2015,  did  the  NSA  have  the  authority 

19 

to  collect  the  transactions  of  a  foreigner  abroad 

20 

with  a  website  in  the  United  States  if  the  website 

21 

contained  a  selector  task  for  collection? 

22 

MR.  PATTON:  Same  objection,  same 
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instruction . 
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2 

THE  WITNESS:  I'll  follow  the 

3 

instruction . 

4 

BY  MR.  ABDO: 

5 

Q  Are  you  aware  that  the  Office  of 

6 

Director  of  National  Intelligence  has  acknowledged 

7 

that  there  was  a  time  when  overcollection  of 

8 

webmail  in-boxes  had  contributed  to  the  --  had 

9 

occurred  under  upstream  collection? 

10 

MR.  PATTON:  Just  a  second. 

11 

(Counsel  conferring.) 

12 

THE  WITNESS:  Can  you  point  to  the 

13 

document  or  provide  whatever  that  is? 

14 

BY  MR.  ABDO: 

15 

Q  I'm  asking  whether  you're  aware  that 

16 

that's  the  case. 

17 

A  I  would  want  to  see  where  exactly  ODNI 

18 

had  said  that  information  to  make  sure  that  I 

19 

wasn't  somehow  going  into  some  sort  of  classified 

20 

discussion . 

21 

Without  the  context  of  what  you're 

22 

saying,  as  we've  seen  a  few  times,  sometimes  the 
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information  on  its  face  looks  like  it  says  one 
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2 

thing,  as  we  just  went  through  with  Raj  De ' s  back 

3 

and  forth.  So  without  seeing  the  context  of 

4 

whatever  that  is,  I  don't  know  how  to  answer. 

5 

Q  Let  me  ask  a  different  question  then. 

6 

Do  you  know  the  answer  to  the  question 

7 

I  asked?  Well,  let  me  ask  that.  Do  you  know  the 

8 

answer  to  the  question  I  asked? 

9 

MR.  PATTON:  Objection,  vague  as  to 

10 

which  question. 

11 

MR.  ABDO:  The  question  being  whether 

12 

you're  aware  that  the  Office  of  Director  of 

13 

National  Intelligence  has  acknowledged  that  one  of 

14 

the  overcollection  problems  that  the  NSA  had  with 

15 

upstream  surveillance  involved  the  collection  of 

16 

webmail  in-boxes?  Do  you  know  the  answer  to  that 

17 

question? 

18 

THE  WITNESS:  Again,  without 

19 

confirming  or  denying,  I  need  to  see  the  document 

20 

you're  referring  to  to  better  understand.  I'm 

21 

just  concerned  I'm  in  classified  territory. 

22 
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BY  MR.  ABDO: 
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2 

Q  I'm  not  asking  you  for  an  answer  to 

3 

that  question.  I'm  asking  whether  you  know  the 

4 

answer  to  that  question  first. 

5 

A  I'm  sorry,  I  don't  know  how  to  answer 

6 

what  you're  saying. 

7 

MR.  GILLIGAN:  It's  circular.  The 

8 

question  is  whether  she  knows,  so  I  don't  know 

9 

whether  she  knows  the  answer  to  that  question  is 

10 

the  same  question. 

11 

MR.  ABDO:  If  forced  to  answer  that 

12 

question,  do  you  know  whether  you  would  say  yes  or 

13 

no?  I'm  not  asking  you  to  say  yes  or  no,  I'm 

14 

asking  whether  you  know  which  one  you  would  say  if 

15 

you  were  forced  to  answer  the  question? 

16 

THE  WITNESS:  And  so  I'm  sorry,  I 

17 

don't  know  what  document  you're  referring  to.  I 

18 

assume  you're  referring  to  some  document  somewhere 

19 

that  ODNI  published,  and  if  I  could  see  that  so 

20 

that  I  could  look  at  it,  I  would  be  able  to  tell 

21 

you  whether  I  know  the  answer  or  not. 

22 

But  in  the  abstract  question  of,  "Do 
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you  know  this?,"  I  can't  answer  one  way  or  the 
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2 

other.  So  without  sort  of  having  some  basis  in 

3 

what  we're  looking  at,  I'm  having  a  hard  time 

4 

answering . 

5 

BY  MR.  ABDO: 

6 

Q  Okay.  Was  the  collection  of  webmail 

7 

in-boxes  in  fact  one  of  the  overcollection 

8 

problems  the  NSA  had  with  upstream  surveillance 

9 

specifically  with  regard  to  multi-communications 

10 

transactions? 

11 

MR.  PATTON:  Just  a  moment. 

12 

(Counsel  conferring.) 

13 

MR.  PATTON:  I  just  want  to  state  for 

14 

the  record  that  neither  the  witness  nor  I  are 

15 

trying  to  be  difficult  here.  We  are  concerned 

16 

about  providing  responses  to  information  that  we 

17 

haven't  seen,  and  so  I  don't  want  to  instruct  the 

18 

witness  not  to  answer  the  question  if  there's  a 

19 

public  document  out  there. 

20 

I  think  it  would  be  better  if  you  show 

21 

it  to  her.  It  will  either  refresh  her 

22 

recollection  and  she'll  be  able  to  explain  whether 
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she's  seen  it  before  or  anything  like  that,  but  at 
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this  point,  she's  not  wanting  to  answer  the 

3 

question,  and  I'm  concerned  that  the  answer  may  be 

4 

classified . 

5 

MR.  ABDO:  Are  you  able  to  determine 

6 

whether  the  answer  is  classified  without  knowing 

7 

whether  there's  a  physical  document  in  the  world 

8 

that  contains  the  information?  Is  that  the 

9 

definition  of  "classified"? 

10 

MR.  PATTON:  No,  it  really  gets  to,  at 

11 

this  particular  point,  we  don't  know  what  it  is 

12 

that  you're  referring  to,  and  it  may  be  an 

13 

unclassified  document  that  the  Director  of 

14 

National  Intelligence  has  said  X,  Y  or  Z.  If 

15 

that's  it,  it  provides  the  context  and  some  form 

16 

of  comfort  for  the  witness,  who  is  being  asked  to 

17 

determine  what's  on  one  side  of  the  classified 

18 

line  and  what's  not  on  the  other. 

19 

She  signed  a  Non-Disclosure  Agreement 

20 

and  is  --  I  mean,  her  responses  to  you  so  far  have 

21 

tried  to  give  you  as  much  unclassified  information 

22 

as  possible.  She's  evidently  concerned  that  if 
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she  provides  a  response  to  this  outside  of  any 
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2 

context  that  she  might  be  violating  that  NDA. 

3 

BY  MR.  ABDO: 

4 

Q  Are  you  aware  that  the  Office  of 

5 

Director  of  National  Intelligence,  on  August  21st 

6 

of  2013,  held  a  conference  call  with  reporters  in 

7 

which  the  Office  of  Director  of  National 

8 

Intelligence  described  the  overcollection  of 

9 

webmail  in-boxes  as  an  example  of  the 

10 

overcollection  problem  the  NSA  experienced  under 

11 

upstream  surveillance  with  regard  to 

12 

multi-communication  transactions? 

13 

MR.  PATTON:  Again,  that  may  have 

14 

occurred  on  August  21st,  2013.  It  may  be  a 

15 

document  that  is  a  newspaper  article  that  may  or 

16 

may  not  be  accurately  depicting  what  ODNI  said  at 

17 

that  time.  And  so  our  concern  again,  in  the 

18 

abstract,  is  whether  or  not  the  information  you're 

19 

providing  is  both  accurate  and  unclassified. 

20 

MR.  ABDO:  Okay.  So  can  I  confirm,  at 

21 

least  for  the  time  being,  are  you  instructing  the 

22 

witness  not  to  answer  the  question? 
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MR.  PATTON:  At  the  moment,  I  don't 
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2 

think  the  witness  is  in  a  position  to  answer  the 

3 

question.  Factually,  I  don't  know  what  it  is  that 

4 

you're  referring  to.  And  given  the  amount  of 

5 

information  that  has  been  provided  through 

6 

unofficial  sources,  our  concern,  and  my  duty  here. 

7 

and  the  witness's  duty,  is  to  protect  classified 

8 

information,  and  we  want  to  provide  as  much 

9 

unclassified  information  as  we  can  -- 

10 

MR.  ABDO:  I  understand.  I'm  just 

11 

asking  a  simple  question,  Rodney.  Are  you 

12 

instructing  the  witness  not  to  answer? 

13 

MR.  GILLIGAN:  Tell  you  what,  if  we 

14 

step  outside,  I  might  be  able  to  suggest  a  way 

15 

around  this . 

16 

MR.  ABDO:  Can  we  go  off  the  record? 

17 

(Off  the  record  at  4:57  p.m.) 

18 

(Resume  5:04  p.m.) 

19 

THE  WITNESS:  Is  there  an  outstanding 

20 

question?  Where  are  we? 

21 

BY  MR.  ABDO: 

22 

Q  There  was .  Let  me  start  with  the 
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question  outstanding,  which  was  are  you  aware  that 
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2 

the  Office  of  Director  of  National  Intelligence 

3 

has  acknowledged  that  the  NSA  has  collected 

4 

webmail  in-boxes  under  upstream  surveillance? 

5 

MR.  PATTON:  Object  to  the  form  as 

6 

beyond  the  scope  of  the  30  (b)  (6)  notice,  and  the 

7 

witness  can  answer  in  her  personal  capacity. 

8 

THE  WITNESS:  I'm  not  aware. 

9 

BY  MR.  ABDO: 

10 

Q  Has  the  NSA  collected  webmail  in-boxes 

11 

as  part  of  upstream  surveillance? 

12 

MR.  PATTON:  Object  to  the  question. 

13 

calls  for  classified  information  and  information 

14 

protected  by  the  statutory  privileges,  and 

15 

instruct  the  witness  not  to  answer  the  question. 

16 

THE  WITNESS:  I  will  follow  the 

17 

instructions . 

18 

BY  MR.  ABDO: 

19 

Q  Okay.  Are  you  familiar  with  the  fact 

20 

that  the  contents  of  Internet  communications  are 

21 

transported  in  what  is  known  as  the  application 

22 

layer  of  Internet  packets? 
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1 

MR.  PATTON:  Object  to  the  question  to 
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2 

the  extent  it  calls  for  classified  --  I'm  sorry. 

3 

I'm  so  used  to  that  --  to  the  extent  it  calls  for 

4 

expert  opinion,  and  that  it's  beyond  the  scope  of 

5 

30 (b)  (6)  . 

6 

THE  WITNESS:  Yes. 

7 

BY  MR.  ABDO: 

8 

Q  Okay.  Are  you  aware  of  the  fact  that 

9 

the  contents  of  an  email  communication  are 

10 

transported  within  the  application  layer  of 

11 

Internet  packets? 

12 

MR.  PATTON:  Same  objections. 

13 

THE  WITNESS:  Yes. 

14 

Isn't  that  what  you  just  asked  me? 

15 

BY  MR.  ABDO: 

16 

Q  The  first  question  was  with  respect  to 

17 

Internet  communications  generally,  and  the  second 

18 

question  was  with  respect  to  email  communications 

19 

specifically . 

20 

A  Okay. 

21 

Q  Is  your  answer  to  both  yes? 

22 

A  Yes.  It  sounded  like  the  same  one. 
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and  I  worried  I  was  missing  something. 
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2 

Q  And  are  you  aware  of  the  fact  that  the 

3 

contents  of  a  website  are  transported  within  the 

4 

application  layer  of  Internet  packets? 

5 

MR.  PATTON:  Same  objections. 

6 

THE  WITNESS:  Yes. 

7 

BY  MR.  ABDO: 

8 

Q  Are  the  filtering  or  screening 

9 

processes  that  you've  described  with  respect  to 

10 

upstream  collection  as  it  operates  --  or 

11 

excuse  me,  upstream  surveillance  as  it  operated  in 

12 

June  2015  --  forms  of  deep  packet  inspection? 

13 

MR.  PATTON:  Objection. 

14 

(Counsel  conferring.) 

15 

MR.  PATTON:  I'm  sorry,  could  you  read 

16 

that  back? 

17 

BY  MR.  ABDO: 

18 

Q  Sure.  Are  the  filtering  or  screening 

19 

processes  that  you've  described  under  upstream 

20 

surveillance  as  conducted  in  June  2015  forms  of 

21 

deep  packet  inspection? 

22 

MR.  PADGETT:  I'm  sorry,  one  key  thing 
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I  didn't  get.  Could  you  read  that  back? 
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2 

(The  reporter  read  back  the  question.) 

3 

MR.  PATTON:  Object  to  the  question 

4 

because  it 

calls  for  classified  information  and 

5 

information 

protected  by  the  statutory  privileges. 

6 

Instruct  the  witness  not  to  answer. 

7 

THE  WITNESS:  I  will  follow  the 

8 

instructions . 

9 

BY  MR.  ABDO: 

10 

Q 

Are  you  familiar  with  the  term  "deep 

11 

packet  inspection"? 

12 

MR.  PATTON:  Object  to  that  question. 

13 

beyond  the 

scope  of  30(b) (6),  and  it  calls  for  an 

14 

expert  opinion. 

15 

THE  WITNESS:  In  the  general  sense  of 

16 

the  word,  as  in  not  specific  to  anything  in 

17 

particular. 

but  known  as  the  outside  world? 

18 

BY  MR.  ABDO: 

19 

Q 

Not  specific  to  upstream  surveillance. 

20 

but  -- 

21 

A 

Yes  . 

22 

Q 

You  are  familiar  with  it? 
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1 

A 

Yes . 

2 

Q 

What  does  it  mean? 

3 

MR.  PATTON:  Same  objections. 

4 

THE  WITNESS:  It's  the  concept  of  — 

5 

I ' m  sorry. 

I'm  — 

6 

BY  MR.  ABDO: 

7 

Q 

Is  it  the  process  of  examining  or 

8 

analyzing  ■ 

the  application  layer  of  packets 

9 

traversing 

the  network? 

10 

MR.  PATTON:  Same  objections. 

11 

THE  WITNESS:  Yeah,  I'm  —  yes.  Yes, 

12 

that's  a  fine  description. 

13 

BY  MR.  ABDO: 

14 

Q 

Tell  me  again  your  position  at  the 

15 

Department 

of  Homeland  Security. 

16 

A 

I  was  the  Senior  Director  for  Privacy 

17 

Compliance 

in  the  Privacy  Office. 

18 

Q 

And  you  participated  in  the  drafting 

19 

of  Privacy 

Impact  Assessments? 

20 

A 

I  did . 

21 

Q 

Were  you  involved  in  the  Privacy 

22 

Impact  Assessments  conducted  for  the  Einstein  2  or 
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1 

Einstein  3  programs? 

2 

A 

Yes,  which  is  why  I  changed  the  answer 

3 

when  you  asked  about  the  four  types  of  sort  of 

-- 

4 

Q 

Ah,  got  it. 

5 

A 

When  I  rechanged  it,  I  realized  that 

6 

would  probably  constitute  what  you  were 

7 

considering 

to  be  surveillance. 

8 

Q 

Network  surveillance? 

9 

A 

Network  surveillance. 

10 

Q 

Did  Einstein  2  involve  deep  packet 

11 

inspection? 

12 

A 

I  honestly  don't  remember. 

13 

MR.  PATTON:  Just  object  to  that 

14 

question  as 

beyond  the  scope  of  30(b)(6).  I'm 

not 

15 

sure  whether 

'  the  answer  is  unclassified  or  not 

16 

since  I  have 

;  not  consulted  with  the  Department 

of 

17 

Homeland  Security,  but  if  the  witness  knows  of 

an 

18 

unclassified  answer,  the  witness  can  give  an 

19 

unclassified  answer. 

20 

BY  MR.  ABDO: 

21 

Q 

Sorry,  please  go  ahead. 

22 

A 

I  apologize,  but  I  don't  remember  what 
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is  classified  or  unclassified  about  the  Einstein  2 
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2 

PIA,  so  unless  you  have  a  copy  of  what  was 

3 

published,  I  can't  speak  to  the  specifics  of  what 

4 

was  in  it. 

5 

Q  Okay.  Are  you  familiar  with 

6 

Einstein  3?  Generally,  not  anything  specific,  but 

7 

are  you  aware  of  the  Department  of  Homeland 

8 

Security's  intrusion  detection  and  intrusion 

9 

prevention  program  known  as  Einstein  3 

10 

Accelerated? 

11 

MR.  PATTON:  Objection  to  beyond  the 

12 

scope  of  30(b) (6),  potentially  classified.  I'll 

13 

have  to  rely  on  the  witness,  who  may  be  more 

14 

familiar  with  the  DHS  program  certainly  than  me. 

15 

If  there's  a  unclassified  answer,  you  can  give  it 

16 

in  your  personal  capacity. 

17 

MR.  ABDO:  Surely  the  existence  of 

18 

this  program  is  unclassified,  but  -- 

19 

MR.  PATTON:  I'm  not  willing  to  take 

20 

the  risk. 

21 

BY  MR.  ABDO: 

22 

Q  Did  you  work  on  the  Privacy  Impact 
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Assessment  for  Einstein  3? 
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2 

MR.  PATTON:  Same  set  of  objections. 

3 

THE  WITNESS:  Generally  speaking,  yes. 

4 

because  every  PIA  that  was  approved  by  the 

5 

Department  of  Homeland  Security  at  that  point  was 

6 

reviewed  by  me . 

7 

BY  MR.  ABDO: 

8 

Q  Okay.  Are  you  aware  that  Einstein  3 

9 

was  part  of  the  comprehensive  cybersecurity 

10 

initiative  announced  by  the  Obama  administration? 

11 

A  Yes . 

12 

MR.  PATTON:  Same  objections. 

13 

THE  WITNESS:  Oh,  sorry. 

14 

BY  MR.  ABDO: 

15 

Q  And  are  you  aware  that,  in  announcing 

16 

that,  the  administration  also  made  clear  that 

17 

Einstein  3  was  implemented  with  the  technological 

18 

support  of  the  NSA? 

19 

MR.  PATTON:  Same  objections. 

20 

THE  WITNESS:  Do  you  have  a  document 

21 

that  provides  that  information? 

22 

MR.  ABDO:  Sure. 
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(Deposition  Exhibit  48  was 
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2 

marked  for  identification.) 

3 

BY  MR.  ABDO: 

4 

Q  You  have  what's  been  marked  as 

5 

Exhibit  48  in  front  of  you,  Ms.  Richards. 

6 

Do  you  recognize  this  document? 

7 

MR.  PATTON:  Object  to  this  document 

8 

as  beyond  the  scope  of  30(b) (6),  but  the  witness 

9 

can  answer  this  and  any  other  series  of  questions 

10 

you  have  that  have  unclassified  answers  and  are 

11 

within  her  personal  knowledge. 

12 

THE  WITNESS:  Yes,  I've  seen  this 

13 

document  before.  It's  been  quite  some  time. 

14 

BY  MR.  ABDO: 

15 

Q  Can  you  tell  us  what  it  is? 

16 

A  It's  the  Comprehensive  National 

17 

Cybersecurity  Initiative. 

18 

There  it  is.  Look  at  that. 

19 

Q  Would  you  turn  to  page  3  of  it,  about 

20 

halfway  down,  two-thirds  of  the  way  down,  the 

21 

sentence  beginning,  "DHS  is  currently  conducting 

22 

a[n]  exercise"  --  I  think  they  meant  an 
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exercise 

--  "to  pilot  the  EINSTEIN  3  capabilities 
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2 

described 

in  this  initiative  based  on  technology 

3 

developed 

by  NSA  to  solidify  processes  for 

4 

managing 

and  protecting  information  gleaned  from 

5 

observed 

cyber  intrusions." 

6 

A 

Yes  . 

7 

Q 

So  is  it  true  that  the  Einstein  3 

8 

program  was  piloted  based  on  technology  developed 

9 

by  the  NSA? 

10 

MR.  PATTON:  Just  a  moment. 

11 

(Counsel  conferring.) 

12 

THE  WITNESS:  Do  you  have  the  date  of 

13 

this  document? 

14 

BY  MR.  ABDO: 

15 

Q 

I  believe  it's  2010,  but  I  don't  know 

16 

off  the  top  of  my  head. 

17 

A 

Could  I  see  your  Einstein  3  PIA? 

18 

Q 

We've  got  another  copy  of  it.  Can  we 

19 

mark  this 

too.  Dawn? 

20 

(Deposition  Exhibit  49  was 

21 

marked  for  identification.) 

22 
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BY  MR.  ABDO: 
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2 

Q 

So  just  for  the  record,  you're  now 

3 

looking  at 

what's  been  marked  as  Exhibit  49. 

4 

Do  you  recognize  that? 

5 

A 

Yes . 

6 

Q 

What  is  that  document? 

7 

A 

The  Privacy  Impact  Assessment  for  the 

8 

National  Protection  and  Programs  Directorate, 

9 

Department 

of  Homeland  Security,  Einstein  3 

10 

Accelerated  (E3A) ,  dated  April  19th,  2013. 

11 

Q 

Okay.  And  for  the  record,  you 

12 

participated  in  the  drafting  of  that  assessment? 

13 

A 

I  reviewed  it. 

14 

Q 

Okay.  If  you're  not  quickly  familiar 

15 

with  the  answer  to  a  question,  that's  fine,  we  can 

16 

move  on. 

I  was  just  asking  whether  the 

17 

Comprehensive  National  Cybersecurity  Initiative  -- 

18 

A 

So  my  answer  to  you  -- 

19 

MR.  PATTON:  Just  a  second. 

20 

THE  WITNESS:  I'm  sorry. 

21 

MR.  PATTON:  Just  preserving  my 

22 

ob j  ection 

that  both  Exhibit  48  and  Exhibit  49, 
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that  series  of  questions  are  outside  the  scope  of 
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2 

30(b) (6),  and  the  witness  is  answering  in  her 

3 

personal  capacity. 

4 

THE  WITNESS:  To  the  extent  that  the 

5 

CNCI  information  is  from  2010,  stating  something 

6 

specific  about  NSA-developed  technology,  and  not 

7 

having  reviewed  this  in  almost  five  years,  I  would 

8 

have  to  look  at  those  and  really  understand 

9 

whether  what  was  described  in  2010  actually  got 

10 

implemented  in  2013. 

11 

MR.  ABDO:  Understood.  Okay. 

12 

MR.  GILLIGAN:  Sorry,  is  that  49 

13 

there? 

14 

MR.  ABDO:  49,  yeah. 

15 

THE  WITNESS:  I  can  read  it  if  you 

16 

would  like  me  to,  but  -- 

17 

BY  MR.  ABDO: 

18 

Q  No,  that's  okay. 

19 

Is  it  correct  that  in  upstream 

20 

collection  that  NSA  obtains  what  it  calls 

21 

transactions? 

22 

A  Internet  transactions. 
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Q  Internet  transactions.  Sorry,  yes. 
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2 

internet  transactions . 

3 

A  Yes . 

4 

Q  Do  the  Internet  packets  that 

5 

constitute  a  single  Internet  transaction  have  a 

6 

common  destination? 

7 

MR.  PATTON:  Objection.  Just  a 

8 

second . 

9 

(Counsel  conferring.) 

10 

MR.  PATTON:  We're  just  trying  to  see 

11 

if  there's  an  unclassified  response  to  that. 

12 

THE  WITNESS:  Uh-uh. 

13 

MR.  PATTON:  Objection,  calls  for  a 

14 

classified  response  and  information  subject  to  the 

15 

statutory  privileges. 

16 

Instruct  the  witness  not  to  answer. 

17 

THE  WITNESS:  Instructions  will  be 

18 

followed . 

19 

BY  MR.  ABDO: 

20 

Q  Okay.  Do  the  Internet  packets  that 

21 

constitute  a  single  Internet  transaction  have  a 

22 

common  source? 
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MR.  PATTON:  Same  objection,  same 
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2 

instruction . 

3 

THE  WITNESS:  Will  follow  the 

4 

instructions . 

5 

BY  MR.  ABDO: 

6 

Q  Are  you  familiar  with  the  term  "flow" 

7 

or  "network  flow"  as  used  in  the  context  of 

8 

Internet  communications? 

9 

MR.  PATTON:  Objection,  it's  beyond 

10 

the  scope  of  30(b) (6),  and  it's  calling  for  an 

11 

expert  opinion. 

12 

THE  WITNESS:  I  am,  but  don't  make  me 

13 

define  them. 

14 

BY  MR.  ABDO: 

15 

Q  Is  an  Internet  transaction,  as 

16 

understood  by  the  NSA,  the  same  as  a  flow  or 

17 

network  flow  as  used  in  the  context  of  Internet 

18 

communications? 

19 

MR.  PATTON:  Just  a  moment.  I  don't 

20 

think  she  can  answer  that. 

21 

THE  WITNESS:  Uh-uh,  no.  No,  I  can't 

22 

answer  that. 
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(Counsel  conferring.) 
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2 

MR.  PATTON:  Same  objection,  same 

3 

instruction . 

4 

THE  WITNESS:  And  will  follow  the 

5 

instruction . 

6 

BY  MR.  ABDO: 

7 

Q  And  the  reason  you  can't  answer  is 

8 

because  it  would  disclose  classified  information? 

9 

A  No. 

10 

Q  Not  because  you're  not  familiar  with 

11 

the  definition  of  "flow"? 

12 

A  No,  not  because  --  no,  that  is 

13 

correct.  I  know  what  flow  is,  I  just  don't  -- 

14 

that's  classified. 

15 

Q  Okay.  Is  the  definition  of  "flow" 

16 

classified? 

17 

MR.  PATTON:  Objection,  beyond  the 

18 

scope . 

19 

BY  MR.  ABDO: 

20 

Q  In  general  as  that  term  is  commonly 

21 

used  in  the  network  communications  industry? 

22 

MR.  PATTON:  Objection,  it's  beyond 
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the  scope,  and  calling  for  telecommunications 
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2 

expert  opinion. 

3 

THE  WITNESS:  As  you've  just 

4 

described,  it's  the  general  meaning.  There's  no 

5 

specific  definition.  Internet  transaction  is  an 

6 

NSA  definition.  It's  not  a  commonly  understood 

7 

telecommunications  one. 

8 

So  it,  like  --  there  was  one  another 

9 

we  had  earlier  today.  So  there's  sort  of 

10 

different  groups  of  NSA-specific  versus  the 

11 

outside  world  would  know  what  they  are.  "Internet 

12 

transaction"  is  one  of  those. 

13 

BY  MR.  ABDO: 

14 

Q  What  about  network  flow,  flow  or 

15 

network  flow? 

16 

A  Those  would  be  the  normal  everyday  use 

17 

of  the  words. 

18 

Q  In  other  words,  the  NSA  doesn't  have  a 

19 

special  definition  of  that  term? 

20 

A  Correct. 

21 

Q  Okay.  Can  we  take  a  five-minute 

22 

break? 
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1 

MR.  PATTON:  Sure. 
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2 

(A  break  was  taken  at  5:21  p.m.) 

3 

(Resume  at  5:35  p.m.) 

4 

EXAMINATION  BY  COUNSEL  EOR 

5 

WIKIMEDIA  EOUNDATION  AND  THE  ACLU 

6 

BY  MR.  TOOMEY: 

7 

Q  Ms.  Richards,  so  I'm  going  to  be 

8 

asking  some  -- 

9 

MR.  ABDO:  Why  don't  you  introduce 

10 

yourself . 

11 

BY  MR.  TOOMEY: 

12 

Q  I'm  Patrick  Toomey.  I'm  counsel  for 

13 

Wikimedia  Eoundation  from  the  American  Civil 

14 

Liberties  Union. 

15 

So  carrying  on,  in  the  course  of 

16 

upstream  surveillance,  does  the  NSA  review  the 

17 

contents  of  communications  as  they  are  in  transit 

18 

on  the  Internet  backbone? 

19 

MR.  PATTON:  Objection,  calls  for 

20 

information  that's  classified,  subject  to  state 

21 

secrets,  and  the  other  statutory  privileges. 

22 

Instruct  the  witness  not  to  answer. 
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THE  WITNESS:  I  will  follow  the 

Page  259 

2 

instructions . 

3 

BY  MR.  TOOMEY: 

4 

Q  Let's  focus  on  the  period  of  June  2015 

5 

for  the  questions  that  follow. 

6 

In  the  course  of  upstream  surveillance 

7 

in  June  2015,  did  the  NSA  review  the  contents  of 

8 

communications  as  they  were  in  transit  on  the 

9 

Internet  backbone? 

10 

MR.  PATTON:  Same  objections,  same 

11 

instructions . 

12 

THE  WITNESS:  Will  follow  the  —  oh. 

13 

MR.  PATTON:  There  are  unclassified 

14 

facts  that  could  come  out  with  different 

15 

questions,  but  for  that  particular  phrasing. 

16 

instruct  her  not  to  answer. 

17 

THE  WITNESS:  Will  follow  the 

18 

instructions . 

19 

BY  MR.  TOOMEY: 

20 

Q  In  the  course  of  upstream  surveillance 

21 

in  June  2015,  did  the  NSA  scan  the  contents  of 

22 

communications  as  they  were  in  transit  on  the 
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2 

MR.  PATTON:  Let  me  just  confer. 

3 

because  there's  a  specific  phrase  that  you're 

4 

using  that  I  think  is  causing  both  NSA  counsel  and 

5 

I  as  a  basis  to  object  on  classified  information. 

6 

So  I  don't  want  to  appear  we're  overclassifying 

7 

Einstein  3. 

8 

MR.  GILLIGAN:  So  we  can  go  off  the 

9 

record . 

10 

MR.  TOOMEY:  Let's  go  off  the  record 

11 

for  a  minute. 

12 

(Off  the  record  at  5:37  p.m.) 

13 

(Resume  at  6:23  p.m.) 

14 

MR.  PATTON:  Can  remind  us  of  where  we 

15 

were? 

16 

MR.  TOOMEY:  Yes.  We're  going  back  on 

17 

the  record,  and,  Ms.  Jaques,  if  you  could  read 

18 

back  the  previous  question,  please. 

19 

(The  reporter  read  back  the  question.) 

20 

MR.  PATTON:  Objection  to  the  question 

21 

to  the  extent  it  calls  for  classified  information 

22 

and  information  protected  by  the  statutory 
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privileges.  The  witness  can  answer  the  question 

Page  261 

2 

to  the  extent  unclassified. 

3 

THE  WITNESS:  So  I  think  what  you're 

4 

asking  is  sort  of  a  two-part  question,  and  so  I 

5 

wanted  to  unpack  and  provide  the  unclassified 

6 

aspects  of  it,  and  then  sort  of  acknowledge  that 

7 

we've  got  the  classified. 

8 

So  as  part  of  the  upstream,  we  scan 

9 

the  content  of  the  Internet  transactions,  and  we 

10 

did  that  in  2015. 

11 

As  to  the  question  of  basically  the  in 

12 

transit  or  the  location,  that  piece  is  classified. 

13 

BY  MR.  TOOMEY: 

14 

Q  Thank  you.  In  June  of  2015,  in  the 

15 

course  of  upstream  surveillance,  did  the  NSA  scan 

16 

the  application  layer  data  of  communications  that 

17 

transit  the  Internet  backbone? 

18 

MR.  PATTON:  I'm  just  listening  to 

19 

your  question.  There's  a  slight  difference  in 

20 

that  that  I  just  need  to  consult. 

21 

(Counsel  conferring.) 

22 

MR.  PADGETT:  Could  you  read  the 
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question? 
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2 

(The  reporter  read  back  the  question.) 

3 

THE  WITNESS:  It's  classified. 

4 

MR.  PATTON:  There's  something 

5 

unclassified . 

6 

MR.  PADGETT:  Can  we  just  go  off  the 

7 

record  for  a  second? 

8 

(Off  the  record  at  6:26  p.m.) 

9 

(Resume  at  6:28  p.m.) 

10 

MR.  PATTON:  And  there  may  be  a  lot  of 

11 

these  back  and  forth  on  this,  so  ... 

12 

THE  WITNESS:  Can  you  repeat  the 

13 

question,  please? 

14 

(The  reporter  read  back  the  question.) 

15 

MR.  PATTON:  Objection  to  the  extent 

16 

it  calls  for  classified  information  or  information 

17 

protected  by  the  statutory  privileges. 

18 

The  witness  can  answer  to  the  extent 

19 

unclassified  about  June  2015. 

20 

THE  WITNESS:  So  to  make  sure  I'm 

21 

accurately  --  I  want  to  make  sure  I'm 

22 

understanding  the  question  and  making  the 
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2 

So  what  you're  saying  is  what  I  just 

3 

said  was  part  of  upstream  in  2015,  we  scanned  the 

4 

content  of  Internet  transactions. 

5 

Your  next  question  is  are  we  --  is  NSA 

6 

scanning  the  application  layer  of  the  Internet  -- 

7 

of  the  Internet  --  that  doesn't  make  sense  --  if 

8 

we're  scanning  the  Internet  --  I'm  sorry,  the 

9 

application  layer? 

10 

BY  MR.  TOOMEY: 

11 

Q  Yes.  The  question  is,  in  June  2015, 

12 

did  the  NSA  scan  the  application  layer  data  of 

13 

communications  that  transit  the  Internet  backbone? 

14 

MR.  PATTON:  Same  objection,  same 

15 

instruction . 

16 

THE  WITNESS:  The  answer  is  yes  for 

17 

2015,  that  we  scan  certain  application  data  of 

18 

communications  that  transit  the  Internet  backbone. 

19 

BY  MR.  TOOMEY: 

20 

Q  When  you  say  certain  -- 

21 

A  Mm-hmm,  that's  important. 

22 

Q  --  application  layer  data,  what  you 
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2 

MR.  PATTON:  Objection,  misstates 

3 

prior  testimony.  Same  objections  as  before,  same 

4 

instruction . 

5 

THE  WITNESS:  I  can't  go  any  further. 

6 

It's  classified. 

7 

BY  MR.  TOOMEY: 

8 

Q  In  unclassified  terms,  in  June  2015, 

9 

how  did  the  NSA  determine  whether  an  Internet 

10 

transaction  contained  a  selector? 

11 

MR.  PATTON:  Object  to  the  extent  it 

12 

calls  for  --  the  whole  answer  would  be  classified. 

13 

The  witness  can  answer  to  the  extent  unclassified. 

14 

THE  WITNESS:  I  just  want  to  refer  to 

15 

see  if  there's  any  additional  information  I  can 

16 

provide  to  you  beyond  what  we've  already  given  to 

17 

you . 

18 

There's  no  additional  information 

19 

beyond  what  was  provided  in  the  Interrogatories  3, 

20 

4  and  5,  so  there's  no  additional  unclassified 

21 

information  beyond  the  fact  that  that's  conducted. 

22 
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BY  MR.  TOOMEY: 
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2 

Q  Is  there  any  classified  information 

3 

that  would  be  responsive  to  that  question? 

4 

A  Yes.  This  is  necessarily  incomplete 

5 

because  of  the  classified  nature  of  the  program. 

6 

Q  And  you're  -- 

7 

MR.  PATTON:  We're  still  talking  about 

8 

June  2015? 

9 

MR.  TOOMEY:  That's  correct,  yes. 

10 

THE  WITNESS:  Still  June  2015,  yes. 

11 

BY  MR.  TOOMEY: 

12 

Q  And  you're  refusing  to  provide  that 

13 

information  on  the  basis  of  an  instruction  from 

14 

your  lawyer? 

15 

MR.  PATTON:  I  haven't  instructed  her 

16 

on  that,  but  her  answer  did  indicate  what  was 

17 

unclassified,  which  was  the  interrogatory 

18 

responses  to  3,  4  and  5,  I  believe  she  said,  and  I 

19 

believe  she  also  said  that  anything  else  beyond 

20 

that  was  classified. 

21 

And  there  wasn't  a  pending  question. 

22 

but  to  the  extent  that  you  asked  her  a  question 
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2 

is,  I  would  instruct  her  not  to  answer. 

3 

BY  MR.  TOOMEY: 

4 

Q  Understood.  Thank  you. 

5 

Today  does  the  NSA  scan  the 

6 

application  layer  data  of  communications  that 

7 

transit  the  Internet  backbone? 

8 

MR.  PATTON:  Objection,  calls  for 

9 

information  that's  classified,  subject  to  the 

10 

statutory  privileges  before  mentioned,  and 

11 

instruct  the  witness  not  to  answer. 

12 

THE  WITNESS:  I  follow  those 

13 

instructions . 

14 

BY  MR.  TOOMEY: 

15 

Q  In  June  of  2015,  if  a  transaction  was 

16 

scanned  by  the  NSA  in  the  course  of  upstream 

17 

surveillance,  and  the  NSA  determined  that  it  did 

18 

not  contain  a  selector,  was  the  communication 

19 

eliminated? 

20 

MR.  PATTON:  Just  a  moment. 

21 

(Counsel  conferring.) 

22 

MR.  PADGETT:  Can  you  read  the 
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2 

(The  reporter  read  back  the  question.) 

3 

MR.  PATTON:  Can  we  just  go  off  the 

4 

record  for  a  second? 

5 

MR.  TOOMEY:  Can  we  go  off  the  record? 

6 

(Off  the  record  at  6:34  p.m.) 

7 

(Resume  at  6:37  p.m.) 

8 

(The  reporter  read  back  the  question.) 

9 

MR.  PATTON:  Object  to  that  question 

10 

to  the  extent  it  calls  for  classified  information 

11 

or  otherwise  privileged  information. 

12 

The  witness  can  answer  to  the  extent 

13 

unclassified . 

14 

THE  WITNESS:  So  the  process  by  which 

15 

Internet  transaction  is  filtered,  and  then 

16 

scanned,  if  it  doesn't  have  a  test  selector  or 

17 

isn't  about  the  target,  then  that  means  that 

18 

information  will  not  be  ingested  into  the  NSA 

19 

repository . 

20 

BY  MR.  TOOMEY: 

21 

Q  And  is  that  communication  eliminated? 

22 

MR.  PATTON:  Objection.  The  question 
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2 

unclassified  one,  which  the  witness  has  already 

3 

given . 

4 

The  witness  can  answer  again  and 

5 

provide  the  unclassified  answer. 

6 

THE  WITNESS:  I  have  nothing 

7 

additional  beyond.  If  you'd  like  me  to  repeat 

8 

what  I  said,  I'd  be  happy  to. 

9 

BY  MR.  TOOMEY: 

10 

Q  No  need  to  repeat. 

11 

And  to  the  extent  there  is  --  is  there 

12 

classified  information  that  you  are  not  providing 

13 

in  response? 

14 

A  Yes . 

15 

Q  Today,  does  the  NSA  seek  to  acquire 

16 

email  communications  to  and  from  its  targets  using 

17 

upstream  surveillance? 

18 

MR.  PATTON:  Object  to  the  question. 

19 

It  calls  for  classified  information  and 

20 

information  protected  by  the  statutory  privileges. 

21 

I  instruct  the  witness  not  to  answer. 

22 

THE  WITNESS:  I  will  follow 
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2 

BY  MR.  TOOMEY: 

3 

Q  Could  you  please  describe  as  fully  as 

4 

possible  how,  in  June  2015,  the  NSA  determined 

5 

whether  an  Internet  transaction  contained  a 

6 

selector? 

7 

MR.  PATTON:  Objection  to  the  extent 

8 

it  calls  for  classified  information,  or 

9 

information  otherwise  protected  by  the  statutory 

10 

privileges . 

11 

The  witness  can  answer  if  she  can 

12 

regarding  the  unclassified  response  to  that 

13 

question . 

14 

THE  WITNESS:  There's  no  additional 

15 

unclassified  information  beyond  what  I've  already 

16 

said . 

17 

BY  MR.  TOOMEY: 

18 

Q  Thank  you.  Beyond  what  you've  already 

19 

said  or  what  appears  in  the  NSA's  discovery 

20 

responses,  could  you  please  describe  as  fully  as 

21 

possible  how  the  NSA  today  determines  whether  an 

22 

Internet  transaction  contains  a  selector? 
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MR.  PATTON:  Objection.  The  question 
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2 

calls  for  classified  information  and  information 

3 

protected  by  the  statutory  privileges,  and 

4 

instruct  the  witness  not  to  answer. 

5 

THE  WITNESS:  I  will  — 

6 

MR.  ABDO:  Rodney,  can  we  just  try  to 

7 

compress  if  it's  the  same  objection?  Thanks. 

8 

MR.  PATTON:  If  you  ask  the  same  -- 

9 

exactly  those  kind  of  questions,  I  will  do  my 

10 

best.  Thank  you. 

11 

THE  WITNESS:  I  will  follow  the 

12 

instructions . 

13 

BY  MR.  TOOMEY: 

14 

Q  In  the  course  of  upstream  surveillance 

15 

in  June  2015,  did  the  NSA  scan  communications  in 

16 

bulk? 

17 

MR.  PATTON:  Objection,  calls  for 

18 

classified  information.  Just  check  and  see  if 

19 

there's  a  -- 

20 

(Counsel  conferring.) 

21 

MR.  PATTON:  Just  a  second.  Can  we  go 

22 

off  the  record? 
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(Off  the  record  at  6:40  p.m.) 
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2 

(Resume  at  6:43  p.m.) 

3 

MR.  TOOMEY:  Can  you  please  repeat  the 

4 

question? 

5 

(The  reporter  read  back  the  question.) 

6 

MR.  PATTON:  Objection.  We'd  need  to 

7 

go  into  the  SCIF  to  discuss  whether  or  not  there's 

8 

an  unclassified  response  to  this. 

9 

THE  WITNESS:  But  before  we  do  that. 

10 

can  you  give  a  definition  of  what  you  mean  by 

11 

"bulk, "  scanning  communications  in  bulk? 

12 

BY  MR.  TOOMEY: 

13 

Q  Does  the  NSA  ever  use  the  term  "bulk" 

14 

in  connection  with  surveillance  activities? 

15 

A  Yes . 

16 

Q  And  what  do  you  understand  the  NSA  to 

17 

mean  by  the  term  "bulk"? 

18 

A  To  do  collection  without  --  let's  see. 

19 

the  definition  is  in  Presidential  Policy  Directive 

20 

No.  28,  which  I  don't  have  with  me,  but  it's 

21 

something  roughly  along  the  lines  of  collection 

22 

without  discriminates. 
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Q  That  document  describes  bulk 
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2 

collection  to  the  best  of  your  recollection? 

3 

A  Yeah. 

4 

Q  Yes? 

5 

A  Or  it  has  a  general  description  of  it. 

6 

and  then  carries  on  to  provide  when  NSA  can 

7 

conduct  bulk  --  for  what  purposes  the  information 

8 

can  be  used. 

9 

Q  And  so  my  question  here  is  about 

10 

whether  in  June  2015,  in  the  course  of  upstream 

11 

surveillance,  the  NSA  scanned  communications  in 

12 

bulk? 

13 

MR.  PATTON:  Go  off  the  record. 

14 

(Off  the  record  at  6:45  p.m.) 

15 

(Resume  at  6:57  p.m.) 

16 

(The  reporter  read  back  the  question.) 

17 

MR.  PATTON:  Objection  to  the  extent 

18 

it  calls  for  classified  information  and 

19 

information  protected  by  the  statutory  privileges. 

20 

Instruct  the  witness  to  answer  the 

21 

question  to  the  extent  able  in  unclassified  terms. 

22 

THE  WITNESS:  So  in  terms  of 
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2 

you  is  in  the  PCLOB  report,  which  is  Deposition 

3 

Exhibit  43,  page  103.  The  last  line  of  the  first 

4 

paragraph  that  states  the  program  does  not  operate 

5 

by  collecting  communications  in  bulk. 

6 

BY  MR.  TOOMEY: 

7 

Q  Could  you  please  answer  my  question 

8 

about  whether  in  June  2015  the  NSA  scanned 

9 

communications  in  bulk? 

10 

MR.  PATTON:  Objection.  The  answer  to 

11 

that  question,  to  the  extent  not  already  provided 

12 

by  the  witness,  is  classified  and  subject  to 

13 

statutory  privileges. 

14 

Instruct  the  witness  not  to  answer. 

15 

MR.  GILLIGAN:  And  state  secrets.  Did 

16 

you  say  state  secrets? 

17 

MR.  PATTON:  I  said  classified.  I'm 

18 

trying  to  shorten  it. 

19 

MR.  GILLIGAN:  Oh,  okay.  We're  all 

20 

for  that. 

21 

MR.  PATTON:  Also  subject  to  the  state 

22 

secrets  privilege. 
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THE  WITNESS:  I  will  follow  the 
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2 

instructions  of  my  counsel. 

3 

BY  MR.  TOOMEY: 

4 

Q  In  the  context  of  upstream 

5 

surveillance,  is  scanning  a  communication 

6 

different  from  collecting  a  communication? 

7 

A  Yes . 

8 

Q  In  the  course  of  upstream  surveillance 

9 

today,  does  the  NSA  scan  communications  in  bulk? 

10 

MR.  PATTON:  Objection.  The  question 

11 

calls  for  information  that's  classified,  subject 

12 

to  the  state  secrets,  and  to  the  statutory 

13 

privileges.  Instruct  the  witness  not  to  answer. 

14 

THE  WITNESS:  I  will  not  answer. 

15 

BY  MR.  TOOMEY: 

16 

Q  In  the  course  of  upstream  surveillance 

17 

today,  does  the  NSA  scan  the  metadata  of 

18 

communications  in  bulk? 

19 

MR.  PATTON:  Same  objections,  same 

20 

instruction . 

21 

THE  WITNESS:  Will  follow  the 

22 

instruction . 
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BY  MR.  TOOMEY: 
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2 

Q  In  the  course  of  upstream  surveillance 

3 

in  2015,  did  the  NSA  copy  communications  in  bulk? 

4 

MR.  PATTON:  Same  objection,  same 

5 

instructions . 

6 

THE  WITNESS:  Eollow  instructions. 

7 

BY  MR.  TOOMEY: 

8 

Q  In  the  course  of  upstream  surveillance 

9 

today,  does  the  NSA  copy  communications  in  bulk? 

10 

MR.  PATTON:  Same  objection,  same 

11 

instruction . 

12 

THE  WITNESS:  Eollow  the  instructions. 

13 

BY  MR.  TOOMEY: 

14 

Q  In  the  course  of  upstream  surveillance 

15 

in  June  of  2015,  did  the  NSA  deliberately  attempt 

16 

to  filter  out  any  of  Wikimedia's  international 

17 

communications? 

18 

MR.  PATTON:  Objection.  Same 

19 

objection,  same  instruction. 

20 

THE  WITNESS:  Will  follow  the 

21 

instruction . 

22 
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BY  MR.  TOOMEY: 
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2 

Q  In  the  course  of  upstream  surveillance 

3 

today,  does  the  NSA  deliberately  attempt  to  filter 

4 

out  any  of  Wikimedia's  international 

5 

communications? 

6 

MR.  PATTON:  Same  instruction,  same 

7 

ob j  ections . 

8 

THE  WITNESS:  Will  follow  instruction. 

9 

BY  MR.  TOOMEY: 

10 

Q  In  the  course  of  upstream  surveillance 

11 

in  June  of  2015,  did  the  NSA  deliberately  attempt 

12 

to  filter  out  all  of  Wikimedia's  communications? 

13 

MR.  PATTON:  Same  objection,  same 

14 

instruction . 

15 

THE  WITNESS:  Will  follow  instruction. 

16 

BY  MR.  TOOMEY: 

17 

Q  In  the  course  of  upstream  surveillance 

18 

today,  does  the  NSA  deliberately  attempt  to  filter 

19 

out  all  Wikimedia  communications? 

20 

MR.  PATTON:  Same  objection,  same 

21 

instruction . 

22 

THE  WITNESS:  Will  follow 
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instructions . 
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2 

BY  MR.  TOOMEY: 

3 

Q  Does  the  NSA  contend  as  a  factual 

4 

matter  in  this  case  that  it  deliberately  filters 

5 

out  all  Wikimedia  communications? 

6 

MR.  PATTON:  Just  a  moment. 

7 

(Counsel  conferring.) 

8 

MR.  PATTON:  Could  you  go  off  the 

9 

record? 

10 

(Off  the  record  at  7:01  p.m.) 

11 

(Resume  at  7:08  p.m.) 

12 

MR.  TOOMEY:  Could  you  read  back  the 

13 

last  question? 

14 

(The  reporter  read  back  the  question.) 

15 

MR.  PATTON:  Object  to  the  question  as 

16 

beyond  the  scope  of  30(b)  (6),  improper  30(b)  (6) 

17 

question.  The  witness  can  answer  in  her  personal 

18 

capacity . 

19 

THE  WITNESS:  In  my  personal  capacity. 

20 

I  have  no  idea,  but  to  the  extent  that  we  do  or  do 

21 

not  filter  something  out  would  be  classified  in 

22 

any  event. 
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BY  MR.  TOOMEY: 
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2 

Q  Does  anyone  at  the  NSA  know  whether 

3 

the  NSA  contends  in  this  case,  as  a  factual 

4 

matter,  that  it  deliberately  filters  out  all 

5 

Wikimedia  communications? 

6 

MR.  PATTON:  Same  objections,  same 

7 

instruction . 

8 

THE  WITNESS:  It's  classified.  I 

9 

mean  -- 

10 

MR.  PATTON:  That's  not  the  question 

11 

he's  asking. 

12 

THE  WITNESS:  That's  not  the  question. 

13 

MR.  PATTON:  That's  not  the  question 

14 

he's  asking. 

15 

THE  WITNESS:  So  same  answer,  which  I 

16 

have  no  idea,  and  to  the  extent  it  is  or  isn't 

17 

would  be  classified. 

18 

BY  MR.  TOOMEY: 

19 

Q  To  the  extent  it  is  or  isn't  what? 

20 

A  Entering  out  Wikimedia,  as  you  were 

21 

contending  in  your  question. 

22 

Q  My  question  is  whether  the  NSA 
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contends  that  it  is  filtering  out  Wikimedia's 
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2 

communications.  Do  you  know  the  answer  to  that 

3 

question? 

4 

MR.  PATTON:  Objection.  Same 

5 

objections  as  before,  and  adding  asked  and 

6 

answered . 

7 

THE  WITNESS:  I  have  nothing  else  to 

8 

say  on  the  topic. 

9 

MR.  TOOMEY:  Ms.  Jaques,  could  you 

10 

mark  as  the  next  exhibit  this  document,  please? 

11 

(Deposition  Exhibit  50  was 

12 

marked  for  identification.) 

13 

BY  MR.  TOOMEY: 

14 

Q  So  the  court  reporter  has  handed 

15 

Ms.  Richards  Exhibit  50,  which  is  titled 

16 

Memorandum  of  Points  and  Authorities  in  Support  of 

17 

Defendant's  Motion  to  Compel  Discovery.  Sorry,  we 

18 

don't  have  as  many  copies  of  this  one,  sorry. 

19 

Could  you  please  tell  me  what  this 

20 

document  is? 

21 

MR.  PATTON:  Objection,  lacks 

22 

foundation . 
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BY  MR.  TOOMEY: 
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2 

Q  You  can  answer. 

3 

Have  you  seen  this  document  before? 

4 

A  I  have  not  seen  this  document  before. 

5 

Q  Can  you  read  the  title  of  the 

6 

document,  please? 

7 

A  Sure.  Memorandum  of  Points  and 

8 

Authorities  in  Support  of  Defendant's  Motion  to 

9 

Compel  Discovery,  dated  March  26,  2018. 

10 

Q  Thank  you.  Could  you  please  turn  to 

11 

page  11  -- 

12 

A  Sure . 

13 

Q  --  of  Exhibit  50? 

14 

I'm  going  to  read  a  sentence  from  the 

15 

document  in  the  last  paragraph  toward  the  bottom 

16 

of  the  page. 

17 

"An  entity  seeking  to  conduct 

18 

surveillance  on  the  Internet  that  lacks  the 

19 

ability  to  decipher  encrypted  HTTPS  communications 

20 

may  well  decide  to  program  its  surveillance 

21 

equipment  to  disregard  such  communications 

22 

altogether . " 
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Has  the  NSA  programmed  its 
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2 

surveillance  equipment  to  disregard  HTTPS 

3 

communications  altogether? 

4 

MR.  PATTON:  Objection,  the  question 

5 

calls  for  classified  information  protected  by  the 

6 

state  secrets  privilege  and  information  protected 

7 

by  the  statutory  privileges. 

8 

Instruct  the  witness  not  to  answer  the 

9 

question . 

10 

THE  WITNESS:  I'll  follow  the 

11 

instructions . 

12 

BY  MR.  TOOMEY: 

13 

Q  Can  we  now  turn  to  page  12  of 

14 

Exhibit  50.  I'm  going  to  read  a  passage  from  the 

15 

first  paragraph  toward  the  top  of  the  page. 

16 

"If  the  NSA  lacked  the  ability  to 

17 

decipher  HTTPS  communications,"  dot  dot  dot,  "then 

18 

nothing  -- 

19 

MR.  PATTON:  It's  an  important  dot  dot 

20 

dot . 

21 

MR.  TOOMEY:  We'll  get  there.  I'm 

22 

going  to  start  again.  I'm  going  to  read  the 
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passage  again. 
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2 

"If  the  NSA  lacked  the  ability  to 

3 

decipher  HTTPS  communications  . . .  then  nothing  in 

4 

the  'technical  rules  of  how  the  Internet 

5 

works'  ...  would  prevent  the  configuration  of 

6 

devices  used  in  connection  with  Upstream 

7 

surveillance  to  exclude  HTTPS  communications." 

8 

Does  the  NSA  have  the  ability  to 

9 

decipher  HTTPS  communications? 

10 

MR.  PATTON:  Objection,  outside  the 

11 

scope  of  30 (b) (6) ,  and  the  question  calls  for 

12 

classified  information  protected  by  the  state 

13 

secrets  privilege,  statutory  privileges. 

14 

Instruct  the  witness  not  to  answer. 

15 

THE  WITNESS:  I  will  follow  the 

16 

instructions . 

17 

BY  MR.  TOOMEY: 

18 

Q  I'm  going  to  read  a  passage  now  from 

19 

page  12  of  Exhibit  50  in  the  second  paragraph 

20 

toward  the  bottom  of  the  page. 

21 

"If  the  NSA  deemed  communications  to 

22 

and  from  Wikimedia's  websites  to  be  of  low 
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foreign-intelligence  value,  then  nothing  in  the 
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2 

technical  rules  of  the  Internet  would  prevent  the 

3 

configuration  of  equipment  used  in  connection  with 

4 

Upstream  surveillance  to  ignore  all  communications 

5 

having  source  or  destination  IP  addresses 

6 

associated  with  Wikimedia." 

7 

Has  the  NSA  configured  its 

8 

surveillance  equipment  to  ignore  all 

9 

communications  having  source  or  destination 

10 

IP  addresses  associated  with  Wikimedia? 

11 

MR.  PATTON:  Objection,  beyond  the 

12 

scope  of  30  (b)  (6) ,  and  objection,  it  calls  for 

13 

classified  information,  subject  to  state  secrets. 

14 

statutory  privileges. 

15 

Instruct  the  witness  not  to  answer. 

16 

THE  WITNESS:  Will  follow  the 

17 

instructions . 

18 

BY  MR.  TOOMEY: 

19 

Q  Does  the  NSA  deem  communications  to 

20 

and  from  Wikimedia's  websites  to  be  of  low  foreign 

21 

intelligence  value? 

22 

MR.  PATTON:  Same  objection,  same 
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instruction . 
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2 

THE  WITNESS:  Will  follow  instruction. 

3 

BY  MR.  TOOMEY: 

4 

Q 

Would  the  NSA  be  permitted  under 

5 

upstream 

surveillance  today  to  collect  a  targets 

6 

communications  with  a  U.S. -based  website? 

7 

A 

How  is  this  question  different  than 

8 

the  last 

one? 

9 

MR.  PATTON:  I'm  not  sure  it  is. 

10 

THE  WITNESS:  Okay. 

11 

MR.  PATTON:  Can  we  go  off  the  record? 

12 

(Off  the  record  at  7:16  p.m.) 

13 

(Resume  at  7:23  p.m.) 

14 

BY  MR.  TOOMEY: 

15 

Q 

Back  on  the  record. 

16 

Ms.  Jaques,  could  you  please  read  back 

17 

the  prior 

question? 

18 

(The  reporter  read  back  the  question.) 

19 

MR.  PATTON:  We  object  to  that 

20 

question . 

It  calls  for  a  classified  answer. 

21 

The  witness  has  reviewed  during  the 

22 

break  the 

currently  applicable  declassified  and 
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public  targeting  procedures,  and  there's  no 
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2 

unclassified  answer  we  can  give.  So  as  a  result. 

3 

we  object  to  the  question,  it  calls  for  classified 

4 

information,  subject  to  the  state  secrets  and 

5 

subject  to  the  statutory  privileges,  and  instruct 

6 

the  witness  not  to  answer. 

7 

THE  WITNESS:  I'll  follow  the 

8 

instructions . 

9 

BY  MR.  TOOMEY: 

10 

Q  Is  it  possible  that  a  targets 

11 

communications  with  Wikimedia  could  contain 

12 

foreign  intelligence  information  that  would  be  of 

13 

interest  to  the  NSA? 

14 

(Counsel  conferring.) 

15 

MR.  PATTON:  You'll  like  this  one. 

16 

Object  as  beyond  the  scope  of  30(b)  (6) 

17 

and  speculative.  The  witness  can  answer  in  her 

18 

own  capacity  to  the  extent  the  answer  is 

19 

unclassified . 

20 

THE  WITNESS:  It's  speculative.  I 

21 

can't  speak  to  who  would  or  wouldn't  be,  what 

22 

particular  individual  might  be  targeted.  If  an 
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analyst  decides  a  particular  selector  or  person 
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2 

meets  the  targeting  standards,  then  that  would  be 

3 

appropriate . 

4 

BY  MR.  TOOMEY: 

5 

Q  Could  the  term  "foreign  intelligence 

6 

information"  encompass  information  that  a  person 

7 

surveilled  using  upstream  surveillance  is  reading 

8 

on  one  of  Wikimedia's  websites? 

9 

MR.  PADGETT:  Could  I  get  that  read 

10 

back? 

11 

(The  reporter  read  back  the  question.) 

12 

MR.  PADGETT:  Do  you  want  to  talk 

13 

about  it?  Let's  go  off  the  record. 

14 

(Off  the  record  at  7:26  p.m.) 

15 

(Resume  at  7:28  p.m.) 

16 

MR.  TOOMEY:  Ms.  Jaques,  could  you 

17 

please  read  back  the  last  question? 

18 

(The  reporter  read  back  the  question.) 

19 

MR.  PATTON:  Objection,  beyond  the 

20 

scope  of  30 (b) (6) ,  speculative,  and  calls  for 

21 

legal  conclusion.  The  witness  can  answer  in  her 

22 

personal  capacity. 
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THE  WITNESS:  I'm  sorry,  can  you  read 
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2 

that  question  one  more  time? 

3 

(The  reporter  read  back  the  question.) 

4 

MR.  PATTON:  Same  objections. 

5 

THE  WITNESS:  Can  we  go  off  the 

6 

record?  Sorry. 

7 

(Off  the  record  at  7:30  p.m.) 

8 

(Resume  at  7:32  p.m.) 

9 

MR.  PATTON:  Same  objections,  same 

10 

instruction . 

11 

THE  WITNESS:  So  you  have  a  couple  of 

12 

different  things,  which  is  why  we  kept  having  to 

13 

walk  outside  to  unpack  that,  and  so  I  want  to 

14 

unpack  what's  classified  and  what's  unclassified. 

15 

So  the  first  part  of  your  question 

16 

would  be  is  there  possibly  foreign  intelligence 

17 

information  on  the  Wikimedia  sites,  to  which  the 

18 

answer,  from  my  perspective,  is  there  could  be.  I 

19 

don't  actually  know.  I  haven't  trolled  through 

20 

the  Wikimedia  websites,  but  it's  possible. 

21 

The  second  part  of  that  question  had 

22 

to  do  with  how  it  would  function  in  the  upstream 
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context,  and  that  piece  of  it  is  what's 
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2 

classified . 

3 

BY  MR.  TOOMEY: 

4 

Q  Similar  question,  could  the  term 

5 

"foreign  intelligence  information"  encompass 

6 

information  that  a  person  surveilled  using 

7 

upstream  surveillance  is  contributing  to  one  of 

8 

Wikimedia's  websites? 

9 

MR.  PATTON:  Same  objections,  same 

10 

instruction . 

11 

THE  WITNESS:  I  would  give  the  same 

12 

answer,  which  is  I  would  separate  those  two  pieces 

13 

to  say  it's  possible  that  somebody  at  one  of  your 

14 

contributors  is  creating  foreign  intelligence 

15 

information  in  a  hypothetical.  I  don't  actually 

16 

know . 

17 

To  the  extent  it  has  anything  to  do 

18 

with  upstream,  any  piece  of  that  would  be 

19 

classified . 

20 

BY  MR.  TOOMEY: 

21 

Q  And  you're  not  answering  that  portion 

22 

to  that  aspect  of  the  question  based  on  your 
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lawyer's  instruction? 

Page  289 

2 

A  Correct. 

3 

MR.  PATTON:  Not  based  on  my 

4 

instruction.  When  we  broke  the  last  time,  the 

5 

witness  had  a  question  as  to  what  aspect  of  this 

6 

that  she  could  talk  about.  She  provided  the 

7 

information  that  she  could  talk  about  and 

8 

indicated  to  you  there's  another  classified 

9 

component,  and  the  nature  of  that  classified 

10 

information,  and  she  declined  to  answer  based  on 

11 

that . 

12 

Had  you  asked  her  a  follow-up  question 

13 

as  to  the  content  of  that  classified  information. 

14 

I  would  have  instructed  her  not  to  answer. 

15 

BY  MR.  TOOMEY: 

16 

Q  Could  you  please  provide  any 

17 

classified  information  that  you  believe  my 

18 

question  calls  for? 

19 

MR.  PATTON:  I  respect  that  question. 

20 

It  keeps  our  record  clean. 

21 

Object  to  the  question  to  the  extent 

22 

it  calls  for  classified  information,  information 
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subject  to  the  statutory  privileges,  and  instruct 
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2 

the  witness  not  to  answer. 

3 

THE  WITNESS:  I  will  follow  those 

4 

instructions . 

5 

BY  MR.  TOOMEY: 

6 

Q  Today,  does  the  NSA  intentionally 

7 

attempt  to  filter  out  all  HTTPS  communications 

8 

from  upstream  surveillance? 

9 

MR.  PATTON:  Objection,  the  question 

10 

calls  for  classified  information,  subject  to  the 

11 

state  secrets  and  to  the  statutory  privileges. 

12 

Instruct  not  to  answer. 

13 

THE  WITNESS:  Will  follow  the 

14 

instruction . 

15 

BY  MR.  TOOMEY: 

16 

Q  Same  question,  but  for  June  2015.  Did 

17 

the  NSA  at  that  time  intentionally  attempt  to 

18 

filter  out  all  HTTPS  communications  from  upstream 

19 

surveillance? 

20 

MR.  PATTON:  Same  objections,  same 

21 

instruction . 

22 

THE  WITNESS:  Will  follow  the 
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2 

BY  MR.  TOOMEY 

; 

3 

Q  Today,  does  the  NSA  intentionally 

4 

attempt  to  filter  out  all 

Internet  communications 

5 

that  use  TCP  port  443? 

6 

MR.  PATTON: 

Same  objections,  same 

7 

instruction . 

8 

THE  WITNESS: 

Eollow  the  instruction. 

9 

BY  MR.  TOOMEY 

: 

10 

Q  In  June  2015, 

did  the  NSA 

11 

intentionally  attempt  to 

filter  out  all  Internet 

12 

communications  that  used 

TCP  port  443? 

13 

MR.  PATTON: 

Same  objections,  same 

14 

instruction . 

15 

THE  WITNESS: 

Eollow  the  instruction. 

16 

BY  MR.  TOOMEY 

; 

17 

Q  Today,  does  the  NSA  intentionally 

18 

filter  out  all  encrypted 

VPN  communications? 

19 

MR.  PATTON: 

Same  objection,  same 

20 

instruction . 

21 

THE  WITNESS: 

Will  follow  the 

22 

instruction . 
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BY  MR.  TOOMEY: 
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2 

Q  In  June  2015,  did  the  NSA 

3 

intentionally  filter  out  all  encrypted  VPN 

4 

communications? 

5 

MR.  PATTON:  Same  objection,  same 

6 

instruction . 

7 

THE  WITNESS:  Eollow  the  instruction. 

8 

BY  MR.  TOOMEY: 

9 

Q  Today,  does  the  NSA  intentionally 

10 

filter  out  all  open  VPN  communications? 

11 

MR.  PATTON:  Same  objection,  same 

12 

instruction . 

13 

THE  WITNESS:  Eollow  the  instruction. 

14 

BY  MR.  TOOMEY: 

15 

Q  In  June  2015,  did  the  NSA 

16 

intentionally  filter  out  all  open  VPN 

17 

communications? 

18 

MR.  PATTON:  Same  objection,  same 

19 

instruction . 

20 

THE  WITNESS:  Will  follow  the 

21 

instruction . 

22 
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BY  MR.  TOOMEY: 
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2 

Q  Today  does  the  NSA  intentionally 

3 

filter  out  Wikimedia's  encrypted  VPN 

4 

communications? 

5 

MR.  PATTON:  Same  objection,  same 

6 

instruction . 

7 

THE  WITNESS:  Will  follow  the 

8 

instruction . 

9 

BY  MR.  TOOMEY: 

10 

Q  In  June  2015,  did  the  NSA 

11 

intentionally  filter  out  Wikimedia's 

12 

encrypted  VPN  communications? 

13 

MR.  PATTON:  Same  objection,  same 

14 

instruction . 

15 

THE  WITNESS:  Will  follow  the 

16 

instruction . 

17 

BY  MR.  TOOMEY: 

18 

Q  Can  you  please  describe  in  as  much 

19 

detail  as  necessary  to  provide  a  complete  answer 

20 

how  the  NSA  implemented  any  changes  to  "about" 

21 

collection  during  or  after  April  2017? 

22 

MR.  PATTON:  Just  a  moment. 
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2 

MR.  PATTON:  Object  to  the  question  to 

3 

the  extent  it  calls  for  classified  information  and 

4 

information  protected  by  the  statutory  privileges. 

5 

If  there  is  an  unclassified  response. 

6 

the  witness  can  provide  it. 

7 

MR.  TOOMEY:  Rodney,  to  be  clear,  just 

8 

so  we  can  try  to  consolidate  things,  are  you  also 

9 

instructing  the  witness  not  to  provide  any 

10 

unclassified  information? 

11 

MR.  PATTON:  No.  I'm  instructing  -- 

12 

MR.  TOOMEY:  Sorry,  any  classified 

13 

information,  just  so  -- 

14 

MR.  PATTON:  I  would  love  her  to 

15 

provide  any  unclassified  information,  but  if 

16 

there's  any  classified  information,  I'm 

17 

instructing  her  not  to  answer. 

18 

There  may  be  some  unclassified 

19 

information  that  she  can  provide,  and  that's  what 

20 

I'm  authorizing  her  to  do. 

21 

THE  WITNESS:  As  of  2017,  April  2017, 

22 

NSA  changed  the  way  it  did  its  upstream  collection 
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so  that  it  no  longer  collected  the  "abouts" 
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2 

collection . 

3 

There's  not  any  additional  information 

4 

beyond  the  information  that  was  either  in  the  2017 

5 

opinion  or  our  associated  unclassified  information 

6 

that  NSA  put  out  on  its  website. 

7 

MR.  PATTON:  That's  the  April  2017 

8 

FISC  opinion? 

9 

THE  WITNESS:  Sorry,  yes,  the 

10 

April  2017  FISC  opinion. 

11 

BY  MR.  TOOMEY: 

12 

Q  Besides  the  information  you  just 

13 

identified,  is  there  any  other  unclassified 

14 

information  that  you  could  provide  to  this 

15 

question? 

16 

MR.  PATTON:  Same  objection,  same 

17 

instruction . 

18 

THE  WITNESS:  Not  that  I'm  aware  of. 

19 

BY  MR.  TOOMEY: 

20 

Q  Is  there  classified  information  that 

21 

would  answer  the  question  that  you  are  not 

22 

providing  at  the  instruction  of  your  attorney? 
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MR.  PATTON:  Objection  to  the  extent 
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2 

it  calls  for  classified  information. 

3 

If  the  witness's  answer  is  yes  or  no. 

4 

she  can  provide  that  information. 

5 

THE  WITNESS:  Yes. 

6 

BY  MR.  TOOMEY: 

7 

Q  Apart  from  the  information  you 

8 

identified  in  response  to  my  last  question,  could 

9 

you  please  describe  how  the  NSA  attempts  to  avoid 

10 

collecting  communications  that  are  solely  about  a 

11 

selector? 

12 

MR.  PATTON:  Object  to  the  form  of  the 

13 

question,  vague  as  to  time.  Potentially 

14 

classified . 

15 

(Counsel  conferring.) 

16 

MR.  PATTON:  Would  you  mind  rephrasing 

17 

to  specify  the  time  period? 

18 

MR.  TOOMEY:  Sure,  I'll  rephrase. 

19 

MR.  PATTON:  Thanks. 

20 

BY  MR.  TOOMEY: 

21 

Q  Apart  from  the  unclassified 

22 

information  that  you  provided  in  response  to  my 
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2 

much  detail  as  necessary  to  provide  a  complete 

3 

answer  how,  after  April  2017,  the  NSA  attempts  to 

4 

avoid  collecting  communications  that  are  solely 

5 

about  a  selector? 

6 

(Counsel  conferring.) 

7 

MR.  PATTON:  Can  we  go  off  the  record? 

8 

(Off  the  record  at  7:42  p.m.) 

9 

(Resume  at  7:43  p.m.) 

10 

MR.  PATTON:  Would  you  mind  reading 

11 

back  the  question,  please? 

12 

(The  reporter  read  back  the  question.) 

13 

MR.  PATTON:  Object  to  the  question  to 

14 

the  extent  it  calls  for  classified  information. 

15 

If  the  witness's  answer  is  yes  or  no. 

16 

she  can  answer  that. 

17 

THE  WITNESS:  There's  no  additional 

18 

information  beyond  what  I've  pointed  to.  I  have 

19 

no  additional  -- 

20 

BY  MR.  TOOMEY: 

21 

Q  There's  no  additional  unclassified 

22 

information? 
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A  No  additional  unclassified 
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2 

information . 

3 

Q  And  is  there  classified  information 

4 

that  you're  not  providing  at  the  instruction  of 

5 

your  counsel? 

6 

A  Yes . 

7 

Q  Apart  from  the  unclassified 

8 

information  that  you  provided  in  response  to  my 

9 

question,  my  previous  question,  please  describe  in 

10 

as  much  detail  as  necessary  to  provide  a  complete 

11 

answer  how  the  change  in  April  2017  affected  the 

12 

filtering  of  communications  subject  to  upstream 

13 

surveillance? 

14 

(Counsel  conferring.) 

15 

MR.  PATTON:  Can  we  go  off  the  record? 

16 

(Off  the  record  at  7:45  p.m.) 

17 

(Resume  at  7:59  p.m.) 

18 

MR.  TOOMEY:  Could  you  please  read 

19 

back  the  last  question? 

20 

(The  reporter  read  back  the  question.) 

21 

MR.  PATTON:  Objection  to  the  question 

22 

to  the  extent  it  calls  for  classified  information 
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and  information  subject  to  the  statutory 
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2 

privileges . 

3 

To  the  extent  the  witness  is  aware  of 

4 

an  unclassified  answer,  she  may  provide  a 

5 

response . 

6 

THE  WITNESS:  The  only  point  I  would 

7 

provide  to  you  on  this,  which  is  not  necessarily 

8 

anything  new,  but  we  still  stand  behind  the 

9 

information  about  how  the  filtering  works  in  our 

10 

Civil  Liberties  and  Privacy  Office  Report,  and 

11 

that  remains  true  today  as  it  did  in  2014,  when  we 

12 

wrote  the  report . 

13 

BY  MR.  TOOMEY: 

14 

Q  Is  there  classified  information  you're 

15 

not  providing  in  response  to  my  question  at  the 

16 

instruction  of  your  lawyer? 

17 

A  Yes . 

18 

Q  Thank  you.  Similar  question,  apart 

19 

from  the  unclassified  information  that  you've 

20 

already  provided  today,  could  you  please  describe 

21 

in  as  much  detail  as  necessary  to  give  a  complete 

22 

answer  how  the  change  in  April  2017  affected  the 
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scanning  of  communications  subject  to  upstream 
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2 

surveillance? 

3 

MR.  PATTON:  Object  to  the  question. 

4 

calls  for  classified  information  and  information 

5 

subject  to  statutory  privileges,  and  instruct  the 

6 

witness  not  to  answer  the  question. 

7 

THE  WITNESS:  I  will  not  answer. 

8 

BY  MR.  TOOMEY: 

9 

Q  Apart  from  the  unclassified 

10 

information  you've  already  provided  today,  please 

11 

describe  in  as  much  detail  as  necessary  to  give  a 

12 

complete  answer  which  portions  of  an  Internet 

13 

transaction  are  scanned  for  selectors  after 

14 

April  2017? 

15 

MR.  PATTON:  Same  objection,  same 

16 

instruction . 

17 

THE  WITNESS:  Will  follow  the 

18 

instruction . 

19 

BY  MR.  TOOMEY: 

20 

Q  Since  April  2017,  does  the  NSA  first 

21 

scan  the  contents  of  communications  for  selectors. 

22 

and  then  discard  those  that  are  solely  about  a 
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selector? 
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2 

MR.  PATTON:  Just  a  moment. 

3 

(Counsel  conferring.) 

4 

MR.  PATTON:  Same  objection,  same 

5 

instruction . 

6 

THE  WITNESS:  Will  follow  the 

7 

instruction . 

8 

BY  MR.  TOOMEY: 

9 

Q  Since  April  2017,  does  the  NSA  copy 

10 

the  contents  of  communications  prior  to  scanning 

11 

those  communications? 

12 

MR.  PATTON:  Same  objection,  same 

13 

instruction . 

14 

THE  WITNESS:  Will  follow  the 

15 

instruction . 

16 

BY  MR.  TOOMEY: 

17 

Q  Since  April  2017,  does  the  NSA  copy 

18 

the  application  layer  data  of  packets  prior  to 

19 

scanning  the  communications  to  which  they  belong? 

20 

MR.  PATTON:  Same  objection,  same 

21 

instruction . 

22 

THE  WITNESS:  Will  follow  the 
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instruction . 
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2 

BY  MR.  TOOMEY: 

3 

Q  Since  April  2017,  does  the  NSA  review 

4 

any  portion  of  the  contents  of  communications  for 

5 

selectors? 

6 

MR.  PATTON:  Object  to  the  form,  vague 

7 

as  to  "review,"  and  object  to  the  question  as 

8 

seeking  classified  information,  subject  to  the 

9 

state  secrets  and  statutory  privileges,  and 

10 

instruct  the  witness  not  to  answer. 

11 

THE  WITNESS:  Will  follow  the 

12 

directions . 

13 

BY  MR.  TOOMEY: 

14 

Q  Would  your  answer  have  been  the  same 

15 

if  I  had  said  does  the  NSA  scan  any  portion  of  the 

16 

contents  of  communications  for  selectors  -- 

17 

MR.  PATTON:  One  moment. 

18 

MR.  TOOMEY:  —  since  April  2017? 

19 

MR.  PATTON:  Just  a  moment. 

20 

(Counsel  conferring.) 

21 

MR.  PATTON:  Could  you  rephrase  the 

22 

question  in  terms  of  an  Internet  transaction? 
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It's  fine  if  you  don't,  but  that  might  take  care 
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2 

of  something. 

3 

MR.  TOOMEY:  Sure,  let  me  rephrase. 

4 

BY  MR.  TOOMEY: 

5 

Q  Since  April  2017,  does  the  NSA  scan 

6 

any  portion  of  the  contents  of  Internet 

7 

transactions  for  selectors? 

8 

(Counsel  conferring.) 

9 

MR.  PATTON:  I  think  we  need  to  go  off 

10 

the  record. 

11 

MR.  TOOMEY:  Let's  go  off  the  record. 

12 

(Off  the  record  at  8:04  p.m.) 

13 

(Resume  at  8:18  p.m.) 

14 

MR.  TOOMEY:  Could  you  please  read 

15 

back  the  prior  question? 

16 

(The  reporter  read  back  the  question.) 

17 

MR.  PATTON:  Objection  to  the  question 

18 

to  the  extent  it  seeks  classified  information  and 

19 

information  protected  by  the  statutory  privileges. 

20 

The  witness  can  answer  the  question  to 

21 

the  extent  that  it's  unclassified. 

22 

THE  WITNESS:  So  NSA  scans  a  portion 
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of  the  Internet  transaction  to  identify  the  task 
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2 

selector  in  order  to  acquire  the  Internet 

3 

transaction  that  is  to  or  from  the  target. 

4 

To  go  any  further  in  terms  of  whether 

5 

it's  in  the  content  or  the  metadata,  or  any  of 

6 

those  further  things,  is  classified. 

7 

MR.  PATTON:  And  I  instruct  her  not  to 

8 

answer  beyond  that  unclassified  answer. 

9 

BY  MR.  TOOMEY: 

10 

Q  And  you're  following  your  counsel's 

11 

instruction? 

12 

A  I  am . 

13 

Q  So  just  to  confirm,  what  portions  of 

14 

the  contents  of  Internet  transactions  are  scanned 

15 

for  selectors  since  April  2017? 

16 

MR.  PATTON:  I  was  waiting  for  you  to 

17 

finish . 

18 

Objection  to  the  extent  that  it 

19 

mischaracterizes  the  prior  testimony.  The  witness 

20 

can  answer  the  question  to  the  extent  it's 

21 

unclassified.  Any  classified  answer,  I  instruct 

22 

her  not  to  provide. 
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THE  WITNESS:  You're  asking  me  what 

Page  305 

2 

portion  of  the  Internet  transaction  we're 

3 

scanning,  just  so  I'm  clarifying? 

4 

BY  MR.  TOOMEY: 

5 

Q  Correct,  after  April  2017. 

6 

A  After  April  2017? 

7 

I  am  not  able  to  answer  that  question. 

8 

The  answer  to  that  question  is  classified. 

9 

Q  Since  April  2017,  does  the  NSA  review 

10 

the  entire  contents  of  communication  of 

11 

Internet  --  let  me  strike  that.  I'll  restate  the 

12 

question . 

13 

Since  April  2017,  does  the  NSA  scan 

14 

the  entire  contents  of  Internet  transactions  for 

15 

selectors? 

16 

MR.  PATTON:  Objection,  calls  for 

17 

classified  information,  information  protected  by 

18 

the  statutory  privileges,  and  instruct  the  witness 

19 

not  to  answer. 

20 

THE  WITNESS:  I  will  follow  the 

21 

instructions . 

22 
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BY  MR.  TOOMEY: 
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2 

Q  Since  April  2017,  does  the  NSA  scan 

3 

any  portion  of  the  application  layer  data  of 

4 

Internet  transactions  for  selectors? 

5 

MR.  PATTON:  Same  objection,  same 

6 

instructions . 

7 

THE  WITNESS:  Will  follow  the 

8 

instruction . 

9 

BY  MR.  TOOMEY: 

10 

Q  And  if  I  were  to  ask  what  portions  of 

11 

Internet  transaction  the  NSA  scans  for  selectors. 

12 

would  your  answer  be  the  same? 

13 

MR.  PATTON:  Are  we  talking  about  post 

14 

April  2017? 

15 

MR.  TOOMEY:  Yes,  post  April  2017. 

16 

MR.  PATTON:  Same  objection,  same 

17 

instruction . 

18 

THE  WITNESS:  Yes,  my  answer  would  be 

19 

the  same. 

20 

BY  MR.  TOOMEY: 

21 

Q  And  since  April  2017,  does  the  NSA 

22 

scan  the  entire  application  layer  of  Internet 
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transactions  for  selectors? 
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2 

MR.  PATTON:  Same  objection,  same 

3 

instruction . 

4 

THE  WITNESS:  Will  follow  the 

5 

instructions . 

6 

BY  MR.  TOOMEY: 

7 

Q  Are  there  any  barriers  to  the  NSA 

8 

restarting  "about"  collection  today? 

9 

MR.  PATTON:  Objection,  beyond  the 

10 

scope  of  30 (b) (6)  notice,  calls  for  a  legal 

11 

conclusion . 

12 

THE  WITNESS:  NSA  — 

13 

MR.  PATTON:  Just  a  second.  There  may 

14 

be  an  additional  objection. 

15 

(Counsel  conferring.) 

16 

MR.  PATTON:  I  would  just  add  that  to 

17 

the  extent  that  the  question  calls  for  a 

18 

classified  answer,  I  object  to  that  based  on  the 

19 

state  secrets  privilege  and  the  statutory 

20 

privileges.  If  there's  an  unclassified  answer. 

21 

the  witness  can  provide. 

22 

And  my  colleague  let's  me  know  that 
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there's  also  a  vagueness  objection. 
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2 

BY  MR.  TOOMEY: 

3 

Q  You  can  answer  to  the  extent  -- 

4 

A  Sure.  With  the  passage  of  the  702  FAA 

5 

Reauthorization,  there  is  a  requirement  for  once 

6 

the  FISC  has  approved  us  going  back  to  "abouts," 

7 

that  we  have  to  give  a  30-day  notice  to  Congress 

8 

before  we  can  move  forward  with  any  type  of 

9 

collection . 

10 

MR.  PATTON:  Any  type  of  "abouts" 

11 

collection . 

12 

THE  WITNESS:  Any  type  of  "abouts" 

13 

collection.  Apologies  for  not  being  clear. 

14 

BY  MR.  TOOMEY: 

15 

Q  Do  you  consider  that  statutory 

16 

requirement  a  barrier  to  the  NSA  restarting 

17 

"about"  collection? 

18 

MR.  PATTON:  Objection,  beyond  the 

19 

scope  of  30 (b) (6) ,  vague  as  to  what  a  barrier  is. 

20 

calls  for  a  legal  conclusion. 

21 

The  witness  can  answer  in  her  own 

22 

capacity . 
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THE  WITNESS:  Can  you  explain  what  you 
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2 

mean  by  barrier?  I  mean,  to  the  extent  --  yeah. 

3 

BY  MR.  TOOMEY: 

4 

Q  I  mean  by  barrier  any  obstacle. 

5 

impediment  to  restarting  "about"  collection. 

6 

MR.  PATTON:  Same  set  of  objections. 

7 

and  add  in  the  one  that  to  the  extent  there's  any 

8 

classified  response  to  that,  the  witness  should 

9 

not  answer  as  to  classified  information.  You  can 

10 

otherwise  provide  an  unclassified  answer  in  your 

11 

personal  capacity. 

12 

THE  WITNESS:  Certainly  getting  EISC 

13 

approval  and  notifying  Congress  are  additional 

14 

barriers  beyond  just  being  able  to  turn  it  on 

15 

tomorrow . 

16 

BY  MR.  TOOMEY: 

17 

Q  And  could  you  please  state  whether 

18 

there  is  any  --  first  of  all,  are  there  any  other 

19 

barriers  besides  the  two  that  you  just  described? 

20 

MR.  PATTON:  Just  a  moment. 

21 

(Counsel  conferring.) 

22 

MR.  PATTON:  Go  off  the  record. 
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(Off  the  record  at  8:25  p.m.) 
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2 

(Resume  at  8:36  p.m.) 

3 

MR.  TOOMEY:  All  right,  let's  go  back 

4 

on  the  record. 

5 

THE  WITNESS:  Can  you  read  it  back? 

6 

(The  reporter  read  back  the  question.) 

7 

THE  WITNESS:  Are  you  answering  first 

8 

or  am  I? 

9 

MR.  PATTON:  Sorry,  putting  this  away. 

10 

Object  to  the  question  to  the  extent 

11 

it  calls  for  classified  information  and 

12 

information  protected  by  the  statutory  privileges. 

13 

The  witness  can  answer  the  question  to 

14 

the  extent  unclassified. 

15 

THE  WITNESS:  So  as  noted,  the  EISC 

16 

would  have  to  approve  us  going  back  to  doing 

17 

"abouts,"  so  we  would  have  to  address  any  of  the 

18 

underlying  issues  as  it  relates  to  getting  the 

19 

EISC  approval,  as  were  described  in  the  2017 

20 

Memorandum  Opinion. 

21 

BY  MR.  TOOMEY: 

22 

Q  What  are  those  underlying  issues? 
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MR.  PATTON:  Object  to  the  question  to 
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2 

the  extent  it  calls  for  classified  information  and 

3 

information  protected  by  the  statutory  privileges. 

4 

The  witness  can  answer  the  question  to 

5 

the  extent  unclassified. 

6 

THE  WITNESS:  So  the  two  unclassified 

7 

descriptions  that  were  provided  in  the  2017 

8 

Memorandum  Opinion  indicated  there  were  both 

9 

technological  issues,  as  well  as  human  error 

10 

issues  . 

11 

BY  MR.  TOOMEY: 

12 

Q  And  what  were  those  issues? 

13 

MR.  PATTON:  Objection  to  the  extent 

14 

it  calls  for  classified  information  and 

15 

information  protected  by  the  statutory  privileges. 

16 

The  witness  can  answer  to  the  extent 

17 

unclassified . 

18 

THE  WITNESS:  Could  I  have  the  2017  so 

19 

I  can  point  you  to  those  sections?  Do  you  want  to 

20 

introduce  that  in?  Is  that  what's  coming  next? 

21 

MR.  TOOMEY:  Could  you  please  mark 

22 

that? 
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(Deposition  Exhibit  51  was 
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2 

marked  for  identification.) 

3 

BY  MR.  TOOMEY: 

4 

Q  Please  take  a  look  at  Exhibit  51  which 

5 

the  court  reporter  has  just  handed  you. 

6 

Could  you  tell  me,  are  you  familiar 

7 

with  this  document  and  what  it  is? 

8 

A  Yes.  This  is  the  Memorandum  Opinion 

9 

and  Order  of  the  foreign  Intelligence  Surveillance 

10 

Court  dated  April  26,  2017. 

11 

So  I  will  start  with  page  14  to  15  -- 

12 

MR.  GILLIGAN:  Sorry,  did  we  mark 

13 

this? 

14 

THE  WITNESS:  Yes,  it's  51. 

15 

So  the  first  indication  of  this 

16 

discussion  is  starting  at  the  bottom  of  page  14. 

17 

The  sentence  begins,  "The  October  26,  2016  Notice 

18 

disclosed  that  an  NSA  Inspector  General  review  and 

19 

report  and  NSA  Office  of  Compliance  for  Operation 

20 

verification  activities  indicated  that,  with 

21 

greater  frequency  than  previously  disclosed  to  the 

22 

Court,  NSA  analysts  had  used  U.S. -person 
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identifiers  to  query  the  results  of  Internet 
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2 

'upstream'  collection,  even  though  NSA's 

3 

Section  702  minimization  procedures  prohibited 

4 

such  queries . " 

5 

BY  MR.  TOOMEY: 

6 

Q  So  if  I  could  stop  you  there. 

7 

A  Sure . 

8 

Q  Is  it  accurate  to  say  that  the 

9 

technical  and  human  error  issues  that  the  FISC 

10 

identified  related  to  queries  of  the  results  of 

11 

Internet  upstream  collection? 

12 

(Counsel  conferring.) 

13 

MR.  PATTON:  If  the  answer  is  yes  or 

14 

no,  the  witness  can  answer  the  question. 

15 

THE  WITNESS:  Yes. 

16 

BY  MR.  TOOMEY: 

17 

Q  Besides  the  barriers  you  already 

18 

identified  and  what's  described  in  Exhibit  51,  are 

19 

there  any  other  barriers  to  the  NSA  restarting 

20 

"about"  collection? 

21 

MR.  PATTON:  Objection  to  the  extent 

22 

that  it  calls  for  classified  information  and 
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information  protected  by  the  statutory  privileges. 
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2 

If  there's  an  unclassified  answer  the 

3 

witness  can  provide,  she  can  provide  it. 

4 

THE  WITNESS:  I'm  sorry,  can  we  go  off 

5 

the  record? 

6 

(Off  the  record  at  8:42  p.m.) 

7 

(Resume  at  8:43  p.m.) 

8 

THE  WITNESS:  To  the  extent  that  NSA 

9 

considers  budget,  time,  intelligence  needs,  risk 

10 

to  the  agency,  privacy  and  civil  liberties  impact. 

11 

all  of  those  will  also  be  considered  as  NSA 

12 

decides  whether  or  not  to  spend  its  next 

13 

intelligence  needs  to  go  into  "abouts." 

14 

Whether  that's  a  particular  barrier  or 

15 

not,  those  are  all  considerations  that  NSA  will 

16 

take  into  consideration  as  it  thinks  about  whether 

17 

or  not  it  should  go  forward  with  "abouts." 

18 

BY  MR.  TOOMEY: 

19 

Q  Okay.  Is  there  any  other  barrier  you 

20 

haven't  already  described? 

21 

A  No. 

22 

Q  Has  the  NSA  disavowed  any  intention  of 
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2 

MR.  PATTON:  Just  a  second. 

3 

(Counsel  conferring.) 

4 

MR.  PATTON:  Just  object  to  beyond  the 

5 

scope  of  30(b) (6) .  The  witness  can  answer  if  she 

6 

knows . 

7 

THE  WITNESS:  No. 

8 

BY  MR.  TOOMEY: 

9 

Q  Has  the  NSA  indicated  to  any  member  of 

10 

Congress  any  interest  in  resuming  "about" 

11 

collection  in  the  future? 

12 

MR.  PATTON:  Just  a  second. 

13 

(Counsel  conferring.) 

14 

MR.  PATTON:  Same  objection  as  beyond 

15 

the  scope  of  30(b) (6) .  The  witness  can  answer  if 

16 

she ' s  aware . 

17 

THE  WITNESS:  Admiral  Rogers  testified 

18 

that  he  would  consider  going  back  up  on  "abouts" 

19 

collection  if  he  could  make  it  through  all  the  -- 

20 

you  know,  if  it  met  the  needs  --  met  intelligence 

21 

needs,  and  they  were  in  a  position  to  meet  all  the 

22 

needs  of  the  EISC  and  notification  to  Congress. 
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BY  MR.  TOOMEY: 
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2 

Q 

Do  you  know  when  Admiral  Rogers 

3 

provided  that  testimony? 

4 

A 

I  want  to  say  roughly  October  time 

5 

frame  2018 

--  I'm  sorry,  sorry  2017  --  in  the 

6 

future.  Somewhere  in  the  September/October  2017. 

7 

It  might  have  been  part  of  one  of  the  threat 

8 

briefings . 

9 

Q 

Do  you  know  to  whom  he  provided  that 

10 

testimony? 

Which  congressional  committee  or  -- 

11 

A 

I  believe  it  was  SSCI,  Senate  Select 

12 

Committee  on  Intelligence.  I'm  pretty  certain 

13 

that's  who 

it  was. 

14 

Q 

Thank  you. 

15 

A 

It  could  have  been  part  of  an 

16 

appropriations  hearing,  but  . . . 

17 

Q 

And  was  that  testimony  public 

18 

testimony? 

19 

A 

Yes,  it  was. 

20 

Q 

Has  the  NSA  indicated  to  the  FISC  any 

21 

interest  in 

resuming  "about"  collection  in  the 

22 

future? 
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MR.  PATTON:  Objection. 
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2 

(Counsel  conferring.) 

3 

MR.  PATTON:  The  objection  is  twofold. 

4 

One,  beyond  the  scope  of  30(b) (6)  and,  two,  object 

5 

to  the  extent  it  calls  for  a  classified  answer. 

6 

and  also  one  subject  to  statutory  privileges.  But 

7 

if  the  witness  is  personally  aware  of  that  fact 

8 

and  it's  unclassified,  she  can  answer. 

9 

THE  WITNESS:  The  answer  is 

10 

classified,  and  I'm  following  the  instructions  of 

11 

my  lawyer. 

12 

BY  MR.  TOOMEY: 

13 

Q  Has  the  NSA  indicated  to  the  EISC  that 

14 

it  intends  to  resume  "about"  collection  in  the 

15 

future? 

16 

MR.  PATTON:  Same  objection,  same 

17 

instruction . 

18 

THE  WITNESS:  Same  answer. 

19 

MR.  TOOMEY:  Can  we  mark  as  the  next 

20 

exhibit,  please,  this  document? 

21 

(Deposition  Exhibit  52  was 

22 

marked  for  identification.) 
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BY  MR.  TOOMEY: 
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2 

Q 

Could  you  please  take  a  look  at 

3 

Exhibit  52 

and  tell  me  if  you  recognize  this 

4 

document  and  what  it  is? 

5 

A 

I  recognize  this  document.  It  is  the 

6 

NSA  press 

release  dated  April  28,  2017,  stating. 

7 

"NSA  Stops 

Certain  foreign  Intelligence  Collection 

8 

Activities 

Under  Section  702." 

9 

Q 

Thank  you.  Let  me  move  to  a 

10 

different 

--  can  we  please  mark  this  document  as 

11 

Exhibit  53? 

12 

(Deposition  Exhibit  53  was 

13 

marked  for  identification.) 

14 

BY  MR.  TOOMEY: 

15 

Q 

Could  you  please  take  a  look  at  this 

16 

document , 

state  whether  you're  familiar  with  it. 

17 

and  describe  it. 

18 

A 

Yes,  I  am  familiar  with  it.  It  is  the 

19 

statement 

from  April  28th,  2017,  stating,  "NSA 

20 

Stops  Certain  Section  702  'Upstream'  Activities." 

21 

Q 

And  I'm  going  to  read  a  short  passage 

22 

from  the  first  paragraph  at  the  end,  which  says. 
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"After  a  comprehensive  review  of  mission  needs. 
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current  technological  constraints.  United  States 

3 

person  privacy  interests,  and  certain  difficulties 

4 

in  implementation,  NSA  has  decided  to  stop  some  of 

5 

its  activities  conducted  under  Section  702." 

6 

Is  that  sentence  accurate? 

7 

A  Yes . 

8 

Q  Did  any  court  order  the  NSA  to  stop 

9 

"about"  collection? 

10 

MR.  PATTON:  One  second. 

11 

(Counsel  conferring.) 

12 

MR.  PATTON:  My  only  objection  is  to 

13 

vagueness  as  to  the  term  "stop"  in  the  context  of 

14 

a  court  order. 

15 

MR.  GILLIGAN:  Beyond  the  scope. 

16 

MR.  PATTON:  It's  also  beyond  the 

17 

scope  then. 

18 

MR.  TOOMEY:  You  can  answer. 

19 

THE  WITNESS:  Actually,  I  would  just 

20 

like  more  specificity.  What  are  you  --  I'm  not 

21 

sure  I  entirely  understand. 

22 

If  you  read  --  maybe  I'll  give  a 
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little  bit  more  answer.  If  you  read  on  the  second 
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2 

page  of  Exhibit  53,  it  states,  "After  considerable 

3 

evaluation  of  the  program  and  available 

4 

technology,  NSA  has  decided  that  its  Section  702 

5 

foreign  intelligence  surveillance  activities  will 

6 

no  longer  include  any  upstream  internet 

7 

communications  that  are  solely  'about'  a  foreign 

8 

intelligence  target." 

9 

So  could  you  be  clearer  of  the 

10 

particular  court? 

11 

BY  MR.  TOOMEY: 

12 

Q  Could  you  read  me  the  title  of 

13 

Exhibit  53? 

14 

A  Sure.  NSA  statement,  "NSA  Stops 

15 

Certain  Section  702  'Upstream'  Activities," 

16 

dated  April  28th,  2017. 

17 

Q  And  my  question  is  did  any  court  order 

18 

the  NSA  to  stop  "about"  collection? 

19 

MR.  PATTON:  Same  objections. 

20 

THE  WITNESS:  Can  you  describe  what 

21 

court  you're  talking  about? 

22 
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1 

BY  MR.  TOOMEY: 
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2 

Q 

I'm  asking  about  any  court. 

3 

A 

Any  court? 

4 

Q 

But  any  court  would  include  the  FISC. 

5 

MR.  PATTON:  Same  objections.  Also, 

6 

this 

particular  one  calls  for  a  legal  conclusion 

7 

too . 

You 

can  answer. 

8 

THE  WITNESS:  Okay. 

9 

So  the  Attorney  General  and  the  DNI 

10 

put  forward  a  set  of  targeting  procedures  to  the 

11 

FISC, 

and 

the  FISC  agreed  with  those  procedures. 

12 

There 

was 

no  FISC  ordering  us  to  stop. 

13 

BY  MR.  TOOMEY: 

14 

Q 

Did  Congress  prohibit  the  NSA  from 

15 

conducting 

"about"  collection  in  April  of  2017? 

16 

MR.  PATTON:  Objection,  vague  as  to 

17 

April 

2017 

Same  set  of  objections  as  before. 

18 

beyond  the 

scope  of  30(b) (6),  calls  for  a  legal 

19 

conclusion 

,  vague . 

20 

THE  WITNESS:  No. 

21 

BY  MR.  TOOMEY: 

22 

Q 

Congress  hasn't  since  prohibited  the 
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NSA  from  restarting  "about"  collection,  correct? 
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MR.  PATTON:  Objection,  beyond  the 

3 

scope,  calls  for  a  legal  conclusion. 

4 

THE  WITNESS:  With  the  passage  of  the 

5 

702  EAA  Reauthorization,  it  puts  in  place  a 

6 

requirement  for  notification  30  days  between  when 

7 

the  Else  approves  it  and  when  we  could  start. 

8 

unless  there's  extenuating  circumstances. 

9 

BY  MR.  TOOMEY: 

10 

Q  So  that  statute  doesn't  contain  a 

11 

prohibition  on  restarting  "about"  collection? 

12 

A  Correct. 

13 

MR.  PATTON:  Same  set  of  objections. 

14 

THE  WITNESS:  Correct. 

15 

BY  MR.  TOOMEY: 

16 

Q  Today,  does  upstream  surveillance 

17 

involve  the  scanning  of  all  international 

18 

text-based  communications  on  individual  circuit  or 

19 

circuits  the  NSA  is  monitoring? 

20 

MR.  PATTON:  Objection,  calls  for 

21 

classified  information  and  information  protected 

22 

by  the  statutory  privileges. 
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Instruct  the  witness  not  to  answer. 
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2 

THE  WITNESS:  I  will  follow 

3 

instructions . 

4 

MR.  GILLIGAN:  Could  I  hear  the 

5 

question 

again,  please? 

6 

(The  reporter  read  back  the  question.) 

7 

MR.  GILLIGAN:  Can  we  go  talk,  please? 

8 

Off  the 

record . 

9 

(Off  the  record  at  8:57  p.m.) 

10 

(Resume  at  9:22  p.m.) 

11 

BY  MR.  TOOMEY: 

12 

Q 

Let's  go  back  on  the  record. 

13 

Ms.  Jaques,  could  you  please  read  back 

14 

the  last 

question? 

15 

(The  reporter  read  back  the  question.) 

16 

MR.  PATTON:  Objection  to  the 

17 

question 

,  that  calls  for  a  classified  answer,  and 

18 

also  an 

answer  that  seeks  information  protected  by 

19 

the  statutory  provisions. 

20 

Instruct  the  witness  not  to  answer. 

21 

THE  WITNESS:  I  will  follow  the 

22 

instructions . 
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MR.  TOOMEY:  So  going  forward,  can  we 
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2 

shorten  that  to  assert  state  secrets  and  statutory 

3 

privileges  ? 

4 

MR.  PATTON:  I  will  shorten  it  as  fast 

5 

as  I  can. 

6 

BY  MR.  TOOMEY: 

7 

Q  In  June  2015,  did  upstream 

8 

surveillance  involve  the  scanning  of  all 

9 

international  text-based  communications  on  the 

10 

individual  circuit  or  circuits  the  NSA  was 

11 

monitoring? 

12 

MR.  PATTON:  Same  objection,  same 

13 

instruction . 

14 

THE  WITNESS:  Will  follow  the 

15 

instructions . 

16 

BY  MR.  TOOMEY: 

17 

Q  Today,  if  some  international 

18 

text-based  communications  on  a  given  circuit  are 

19 

not  scanned,  please  explain  in  as  much  detail  as 

20 

necessary  to  completely  answer  why  those 

21 

communications  are  not  scanned. 

22 

MR.  PATTON:  Please  repeat  the 
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question . 
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2 

(The  reporter  read  back  the  question.) 

3 

MR.  PATTON:  Object  to  the  question  to 

4 

the  extent  it  calls  for  classified  information  and 

5 

information  protected  by  the  statutory  privileges. 

6 

The  witness  can  answer  the  question  to 

7 

the  extent  that  she  is  aware  of  an  unclassified 

8 

answer  to  that  question. 

9 

THE  WITNESS:  Can  you  read  the 

10 

question  one  more  time  to  make  sure  I  have  it 

11 

entirely  accurate? 

12 

(The  reporter  read  back  the  question.) 

13 

THE  WITNESS:  As  we  were  discussing  in 

14 

the  existing  Civil  Liberties  and  Privacy  Report, 

15 

the  process  is  that  there's  filtering,  and  then 

16 

there's  scanning.  So  to  the  extent  that  we  have 

17 

filtered  wholly  domestic  communications  out  as 

18 

part  of  that,  those  would  not  be  scanned. 

19 

BY  MR.  TOOMEY: 

20 

Q  Beyond  that  response  and  beyond  the 

21 

unclassified  information  you've  already  provided 

22 

today,  can  you  please  fully  explain  in  as  much 
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detail  as  necessary  why  some  communications  are 
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2 

not  scanned? 

3 

MR.  PATTON:  Object  to  the  question. 

4 

calls  for  classified  information,  information 

5 

protected  by  the  statutory  privileges. 

6 

Instruct  not  to  answer. 

7 

THE  WITNESS:  Will  follow  the 

8 

instructions . 

9 

BY  MR.  TOOMEY: 

10 

Q  Same  question  as  of  June  2015.  If  you 

11 

need  me  to  restate  the  question,  I  can. 

12 

A  Can  you  restate  the  question? 

13 

Q  Apart  from  the  unclassified 

14 

information  you've  already  provided  today,  as  of 

15 

June  2015,  if  some  international  text-based 

16 

communications  on  a  given  circuit  were  not 

17 

scanned,  please  explain  in  as  much  detail  as 

18 

necessary  to  fully  answer  why  those  communications 

19 

are  not  scanned. 

20 

MR.  PATTON:  Just  a  moment. 

21 

(Counsel  conferring.) 

22 

MR.  PATTON:  Object  to  the  question. 
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2 

protected  by  the  statutory  privileges. 

3 

If  there's  any  information  that  the 

4 

witness  is  aware  of  that  has  not  already  been 

5 

provided  either  in  the  interrogatory  responses  or 

6 

in  the  prior  testimony  that  would  answer  that 

7 

question,  she  can  go  ahead  and  give  it. 

8 

If  not,  I  would  instruct  her  not  to 

9 

answer  the  question  based  on  those  privileges. 

10 

THE  WITNESS:  There's  no  additional 

11 

information,  so  I'll  follow  counsel's  directions. 

12 

BY  MR.  TOOMEY: 

13 

Q  There's  no  additional  unclassified 

14 

information? 

15 

A  There's  no  additional  unclassified 

16 

information  that  I  can  provide  you  beyond  what 

17 

we've  already  provided  you. 

18 

Q  And  there  is  classified  information 

19 

which  you're  not  providing  based  on  your  counsel's 

20 

instruction? 

21 

MR.  PATTON:  To  the  extent  that  the 

22 

answer  to  that  question  is  yes  or  no,  you  can 
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2 

THE  WITNESS:  Yes,  that's  correct. 

3 

MR.  TOOMEY:  Thank  you.  Let's  go  off 

4 

record . 

5 

(Off  the  record  at  9:29  p.m.) 

6 

(Resume  at  9:39  p.m.) 

7 

EXAMINATION  BY  COUNSEL  EOR  PLAINTIEES 

8 

BY  MS.  HANLEY  COOK: 

9 

Q  Hi,  I'm  Devon  Hanley  Cook.  We  spent 

10 

the  day  together,  but  nice  to  meet  you.  I  want  to 

11 

thank  you  for  your  patience  and  for  putting  up 

12 

with  all  our  questions  and  going  so  late  today.  I 

13 

also  want  to  thank  you.  Dawn.  I  know  it's  been  a 

14 

really  long  day  for  everybody. 

15 

Does  NSA  now  scan  Wikimedia's 

16 

communications  in  the  course  of  upstream 

17 

surveillance? 

18 

MR.  PATTON:  Objection,  calls  for 

19 

classified  information,  subject  to  state  secrets 

20 

privilege  and  to  statutory  privileges. 

21 

Instruct  the  witness  not  to  answer. 

22 

THE  WITNESS:  I  will  follow  the 
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2 

BY  MS.  HANLEY  COOK: 

3 

Q  In  2015,  did  NSA  scan  Wikimedia 

4 

communications  in  the  course  of  upstream 

5 

surveillance? 

6 

MR.  PATTON:  Same  objection,  same 

7 

instruction . 

8 

THE  WITNESS:  Will  follow  the 

9 

instruction . 

10 

BY  MS.  HANLEY  COOK: 

11 

Q  Does  NSA  now  copy  Wikimedia 

12 

communications  in  the  course  of  upstream 

13 

surveillance? 

14 

MR.  PATTON:  Same  objection,  same 

15 

instruction . 

16 

THE  WITNESS:  Will  follow  the 

17 

instruction . 

18 

BY  MS.  HANLEY  COOK: 

19 

Q  In  June  2015,  did  NSA  copy  Wikimedia 

20 

communications  in  the  course  of  upstream 

21 

surveillance? 

22 

MR.  PATTON:  Same  objection,  same 
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2 

THE  WITNESS:  Will  follow  the 

3 

instruction . 

4 

BY  MS.  HANLEY  COOK: 

5 

Q  Has  NSA  acquired  Wikimedia 

6 

communications  as  a  result  of  upstream 

7 

surveillance  now? 

8 

MR.  PATTON:  Same  objection,  same 

9 

instruction . 

10 

THE  WITNESS:  Will  follow  the 

11 

instruction . 

12 

BY  MS.  HANLEY  COOK: 

13 

Q  As  of  June  2015,  had  NSA  acquired 

14 

Wikimedia  communications  as  a  result  of  upstream 

15 

surveillance? 

16 

MR.  PATTON:  Same  objection,  same 

17 

instruction . 

18 

THE  WITNESS:  Will  follow  the 

19 

instructions . 

20 

BY  MS.  HANLEY  COOK: 

21 

Q  Can  I  have  Tab  X,  please?  Let's  save 

22 

time,  let's  do  X  and  Y,  please. 
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2 

THE  REPORTER:  Yes,  54  and  55. 

3 

(Deposition  Exhibits  54  and  55 

4 

were  marked  for  identification.) 

5 

BY  MS.  HANLEY  COOK: 

6 

Q 

Let's  start  with  Exhibit  54. 

7 

Have  you  seen  Exhibit  54  before? 

8 

MR.  PATTON:  Just  a  second. 

9 

(Counsel  conferring.) 

10 

MR.  PATTON:  Object  to  the  question  as 

11 

beyond  30  (b) 

(6) .  The  witness  can  answer  yes  or  no 

12 

if  she  has  personally  seen  this  Exhibit  54  before. 

13 

THE  WITNESS:  No. 

14 

BY  MS.  HANLEY  COOK: 

15 

Q 

If  you  assumed  that  Exhibit  54  related 

16 

to  upstream 

surveillance,  it  would  indicate. 

17 

wouldn't  it. 

that  the  NSA  had  an  intelligence 

18 

interest  in 

Wikimedia's  communications,  wouldn't 

19 

it? 

20 

MR.  PATTON:  Object  to  the  question. 

21 

calls  for  a 

classified  answer,  subject  to  the 

22 

state  secrets  privilege  and  to  the  statutory 
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2 

Instruct  the  witness  not  to  answer  the 

3 

question . 

4 

THE  WITNESS:  Will  follow  those 

5 

instructions . 

6 

BY  MS.  HANLEY  COOK: 

7 

Q  Turning  to  Exhibit  55,  have  you  seen 

8 

this  document  before?  Actually,  let  me  -- 

9 

Exhibit  54.  Recognizing  that  you  have  not  seen 

10 

the  document  before,  what  do  you  think  it  is? 

11 

MR.  PATTON:  Objection.  Same 

12 

objection  as  before,  same  instruction. 

13 

THE  WITNESS:  Which  instruction  was 

14 

that?  Classified? 

15 

MR.  PATTON:  Classified,  subject  to 

16 

the  state  secrets  privilege  and  to  statutory 

17 

privileges . 

18 

The  witness  is  instructed  not  to 

19 

answer  the  question. 

20 

THE  WITNESS:  I  will  follow  those 

21 

instructions.  I  just  had  to  make  sure  I  knew  what 

22 

the  instructions  were . 
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2 

Q  Makes  sense. 

3 

Exhibit  55,  have  you  seen  this 

4 

document  before? 

5 

MR.  PATTON:  Object  to  the  question  to 

6 

the  extent  it's  beyond  30(b) (6) .  The  witness  can 

7 

answer  yes  or  no  if  she  has  seen  this  document  in 

8 

her  personal  capacity. 

9 

THE  WITNESS:  Yes. 

10 

BY  MS.  HANLEY  COOK: 

11 

Q  What  is  it? 

12 

MR.  PATTON:  Object  to  the  question. 

13 

calls  for  a  classified  answer,  subject  to  the 

14 

state  secrets  and  to  statutory  privileges. 

15 

Instruct  the  witness  not  to  answer. 

16 

THE  WITNESS:  I  will  follow  those 

17 

instructions . 

18 

BY  MS.  HANLEY  COOK: 

19 

Q  If  you  assumed  that  Exhibit  55  related 

20 

to  upstream  surveillance,  it  would  indicate. 

21 

wouldn't  it,  particularly  on  the  second  page  in 

22 

the  first  bullet  point,  that  the  NSA  has  an 
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2 

communications,  wouldn't  it? 

3 

MR.  PATTON:  Same  objection,  same 

4 

instruction . 

5 

THE  WITNESS:  Will  follow  those 

6 

instructions . 

7 

BY  MS.  HANLEY  COOK: 

8 

Q  Do  Exhibits  54  or  55  relate  to 

9 

upstream  surveillance? 

10 

MR.  PATTON:  Same  objection,  same 

11 

instruction . 

12 

THE  WITNESS:  Will  follow  those 

13 

instructions . 

14 

BY  MS.  HANLEY  COOK: 

15 

Q  At  this  time,  HTTP  communications  are 

16 

scanned  for  selectors  in  the  course  of  upstream 

17 

surveillance,  aren't  they? 

18 

MR.  PATTON:  Just  a  second. 

19 

(Counsel  conferring.) 

20 

MR.  PATTON:  Same  objection,  same 

21 

instructions.  Do  you  need  a  reminder  on  the  -- 

22 

THE  WITNESS:  I  just  need  to  remind 
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2 

MR.  PATTON:  Do  you  need  the  question 

3 

read  back? 

4 

THE  WITNESS:  Could  you  read  the 

5 

question  again? 

6 

(The  reporter  read  back  the  question.) 

7 

MR.  PATTON:  Object  to  the  question. 

8 

calls  for  classified  information,  information 

9 

protected  by  the  statutory  privileges,  and 

10 

instruct  the  witness  not  to  answer. 

11 

THE  WITNESS:  I  will  follow  those 

12 

instructions . 

13 

BY  MS.  HANLEY  COOK: 

14 

Q  As  of  June  2015,  HTTP  communications 

15 

were  scanned  for  selectors  in  the  course  of 

16 

upstream  surveillance,  right? 

17 

MR.  PATTON:  Same  objection,  same 

18 

instruction . 

19 

THE  WITNESS:  Will  follow  the 

20 

instructions . 

21 

BY  MS.  HANLEY  COOK: 

22 

Q  At  this  time,  HTTPS  communications  are 
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scanned  for  selectors  in  the  course  of  upstream 
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2 

surveillance,  aren't  they? 

3 

MR.  PATTON:  Same  objection,  same 

4 

instruction . 

5 

THE  WITNESS:  Will  follow  the 

6 

instruction . 

7 

BY  MS.  HANLEY  COOK: 

8 

Q  Same  question  as  to  the  June  2015  time 

9 

frame . 

10 

MR.  PATTON:  Same  objection,  same 

11 

instruction . 

12 

THE  WITNESS:  Will  follow  the 

13 

instruction . 

14 

BY  MS.  HANLEY  COOK: 

15 

Q  Are  Apache  Kafka  communications 

16 

scanned  for  selectors  in  the  course  of  upstream 

17 

surveillance? 

18 

MR.  PATTON:  Same  objection,  same 

19 

instruction . 

20 

THE  WITNESS:  Will  follow  the 

21 

instruction . 

22 
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2 

Q  Do  you  know  what  Apache  Kafka 

3 

communications  are? 

4 

MR.  PATTON:  Object  to  the  question. 

5 

beyond  the  scope,  calls  for  expert  testimony. 

6 

The  witness  can  answer  in  her  personal 

7 

capacity . 

8 

THE  WITNESS:  Not  well  enough  to 

9 

describe  to  you. 

10 

BY  MS.  HANLEY  COOK: 

11 

Q  Open  VPN  communications  are  scanned 

12 

for  selectors  in  the  course  of  upstream 

13 

surveillance,  aren't  they? 

14 

MR.  PATTON:  Objection,  vague  as  to 

15 

time  period,  calls  for  classified  information  and 

16 

information  protected  by  the  statutory  privileges. 

17 

Instruct  the  witness  not  to  answer. 

18 

THE  WITNESS:  Will  follow  the 

19 

instruction . 

20 

BY  MS.  HANLEY  COOK: 

21 

Q  As  of  June  2015,  were  open  VPN 

22 

communications  scanned  for  selectors  in  the  course 
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2 

MR.  PATTON:  Same  objection  without 

3 

the  vague  as  to  time. 

4 

Same  instruction  not  to  answer. 

5 

THE  WITNESS:  Will  follow  the 

6 

instruction . 

7 

BY  MS.  HANLEY  COOK: 

8 

Q  Other  than  public  documents,  public 

9 

documents  at  large,  hearing  testimony  that  is 

10 

transcribed,  public  documents  you  reviewed. 

11 

documents  that  have  been  filed  or  served  in  this 

12 

case,  or  your  testimony  today,  what  can  you  tell 

13 

me  about  the  volume  of  communications  subject  to 

14 

upstream  surveillance  at  this  time  using  any  unit 

15 

of  measurement  you  want  to  discuss  volume  of 

16 

communications? 

17 

MR.  PATTON:  Just  one  moment. 

18 

Can  we  go  off  the  record? 

19 

(Off  the  record  at  the  9:49  p.m.) 

20 

(Resume  at  9:49  p.m.) 

21 

MR.  PATTON:  Could  you  read  back  the 

22 

question,  please? 
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2 

MR.  PATTON:  Other  than  the  officially 

3 

disclosed  government  statements,  whether  they  be 

4 

publicly  by  ODNI  or  by  NSA  or  filed  in  this 

5 

particular  case  or  filed  in  the  FISC  and 

6 

declassified,  any  other  information  that  the 

7 

witness  would  have  would  be  classified,  and  so  I 

8 

would  instruct  her  not  to  answer  the  question 

9 

based  on  the  state  secrets  privilege  and  statutory 

10 

privileges . 

11 

THE  WITNESS:  I'll  follow  the 

12 

instructions . 

13 

BY  MS.  HANLEY  COOK: 

14 

Q  Okay.  How  many  communications  --  and 

15 

you  can  use  any  unit  of  measurement  you  want  -- 

16 

did  NSA  retain  as  a  result  of  upstream 

17 

surveillance  in  each  of  the  last  three  years? 

18 

MR.  PATTON:  Objection,  vague  as  to 

19 

the  term  "communication,"  and  classified,  subject 

20 

to  the  state  secrets  privilege  and  statutory 

21 

privileges,  and  instruct  not  to  answer. 

22 

THE  WITNESS:  Will  follow  the 

TransPerfect  Legal  Solutions 
212-400-8845  -  Depo@TransPerfect.com 


(aEEaasILffi5gwqHBaaSg-~n^  PanmirnaaittJBB-^  fftltestJISfflaSfflaB 


1 

instruction . 

Page  340 

2 

BY  MS.  HANLEY  COOK: 

3 

Q  Same  question  as  to  transactions. 

4 

MR.  PATTON:  Same  objections  except 

5 

for  vagueness,  same  instruction. 

6 

THE  WITNESS:  I  will  follow  the 

7 

instructions . 

8 

BY  MS.  HANLEY  COOK: 

9 

Q  What  is  the  volume  of  communications 

10 

copied  in  the  course  of  upstream  surveillance  in 

11 

each  of  the  last  three  years? 

12 

MR.  PATTON:  Objection,  vague. 

13 

Objection,  seeks  classified  information  protected 

14 

by  the  state  secrets  privilege,  statutory 

15 

privileges,  instruct  not  to  answer. 

16 

THE  WITNESS:  I  will  follow  the 

17 

instructions . 

18 

BY  MS.  HANLEY  COOK: 

19 

Q  Same  question  as  to  transactions. 

20 

MR.  PATTON:  Same  objections  with 

21 

exception  of  vagueness,  same  instruction. 

22 

THE  WITNESS:  Eollowing  the 
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2 

BY  MS.  HANLEY  COOK: 

3 

Q  What  is  the  volume  of  communications 

4 

or  transactions  that  are  subject  to  filtering  in 

5 

the  course  of  upstream  surveillance  in  the  last 

6 

three  years? 

7 

MR.  PATTON:  I'm  sorry,  did  you  use 

8 

the  term  "Internet  transactions"? 

9 

MS.  HANLEY  COOK:  No. 

10 

MR.  PATTON:  I'm  sorry,  could  you  read 

11 

the  question  back? 

12 

(The  reporter  read  back  the  question.) 

13 

MR.  PATTON:  Objection,  vague  as  to 

14 

communications,  and  objection  to  the  rest  for  the 

15 

same  reasons  set  forth  before,  instruct  not  to 

16 

answer . 

17 

THE  WITNESS:  Will  follow  the 

18 

instructions . 

19 

BY  MS.  HANLEY  COOK: 

20 

Q  Would  the  answer  be  the  same  if  I  used 

21 

the  term  "Internet  transactions"? 

22 

MR.  PATTON:  The  instruction  not  to 
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2 

vagueness  objection,  if  that  helps,  or  deemed 

3 

compound  since  it  was  previous  communications  or 

4 

transactions,  but  the  instruction  not  to  answer 

5 

would  remain  the  same,  yes. 

6 

(Deposition  Exhibit  56  was 

7 

marked  for  identification.) 

8 

BY  MS.  HANLEY  COOK: 

9 

Q  Please  take  a  look  at  Exhibit  56. 

10 

Have  you  seen  this  document  before? 

11 

MR.  PATTON:  We  need  to  go  off  the 

12 

record . 

13 

MS.  HANLEY  COOK:  Okay. 

14 

(Off  the  record  at  9:53  p.m.) 

15 

(Resume  at  9:59  p.m.) 

16 

BY  MS.  HANLEY  COOK: 

17 

Q  The  question  was  have  you  seen  this 

18 

document  before? 

19 

MR.  PATTON:  Objection  as  beyond  the 

20 

scope  of  30(b) (6) .  The  witness  can  answer  in  her 

21 

personal  capacity  if  she's  seen  the  document 

22 

before  . 
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THE  WITNESS:  I've  certainly  seen 

2 

portions 

of  it.  I'm  not  sure  I  saw  it  in  its 

3 

entirety 

when  I  was  working  at  DHS.  I  don't  know 

4 

that  I  saw  it  all  in  its  entirety. 

5 

BY  MS.  HANLEY  COOK: 

6 

Q 

What  is  it? 

7 

MR.  PATTON:  Same  objection. 

8 

THE  WITNESS:  Memorandum  Opinion  for 

9 

the  Counsel  to  the  President  on  legal  issues 

10 

relating 

to  the  testing,  use,  and  deployment  of  an 

11 

intrusion 

detection  system  (Einstein  2.0)  to 

12 

protect  unclassified  computer  networks  in  the 

13 

Executive 

Branch,  dated  January  9,  2009. 

14 

BY  MS.  HANLEY  COOK: 

15 

Q 

Thank  you.  Please  turn  to  page  4  of 

16 

Exhibit  56,  the  second  paragraph  that  begins 

17 

"EINSTEIN 

2.0." 

18 

A 

Mm-hmm . 

19 

Q 

I'd  like  you  to  read  the  first  two 

20 

sentences 

to  yourself,  and  tell  me  when  you're 

21 

done . 

22 

A 

(Witness  reviewing  document.)  Yeah. 
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2 

sensors  will  scan  a  temporary  copy  of  traffic. 

3 

right? 

4 

MR.  PATTON:  Same  objections. 

5 

THE  WITNESS:  That's  what  the  sentence 

6 

says,  yes. 

7 

BY  MS.  HANLEY  COOK: 

8 

Q  Is  that  sentence  containing  "temporary 

9 

copy"  accurate  to  the  best  of  your  knowledge? 

10 

MR.  PATTON:  Same  objection,  lack  of 

11 

foundation  as  well. 

12 

THE  WITNESS:  To  the  extent  that  I  at 

13 

some  point  reviewed  a  Privacy  Impact  Assessment 

14 

associated  with  Einstein  1  or  Einstein  2,  it  was 

15 

many  years  ago,  so  I  can't  speak  to  whether  the 

16 

specificity  --  I  didn't  review  this  document  in 

17 

advance  of  any  of  this  conversation,  so  I  would 

18 

want  to  go  back  and  look  at  all  those  materials 

19 

before  I  gave  you  an  answer  one  way  or  the  other. 

20 

I  have  no  reason  to  say  it's  not,  but 

21 

I  have  no  reason  to  know  whether  that  was  exactly 

22 

how  it  was  implemented,  or  whether  it  remains  true 
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today . 
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2 

BY  MS.  HANLEY  COOK: 

3 

Q  But  this  document  at  least  says  that 

4 

it  will  create  a  temporary  copy,  right? 

5 

MR.  PATTON:  Objection,  the  document 

6 

speaks  for  itself. 

7 

THE  WITNESS:  Yes,  that's  what  the 

8 

sentence  says . 

9 

BY  MS.  HANLEY  COOK: 

10 

Q  The  next  sentence  that  I  had  you  read 

11 

says  that,  "Einstein  2.0  operations  will  not 

12 

disrupt  the  normal  operations  of  federal  systems." 

13 

Did  I  read  that  right? 

14 

A  Yes,  you  did. 

15 

Q  Do  you  know  why  Einstein  2  involves 

16 

the  creation  of  a  temporary  copy  of  the  traffic 

17 

being  scanned? 

18 

MR.  PATTON:  Objection,  beyond  the 

19 

scope  of  30  (b)  (6) ,  calls  for  --  it  also  --  it  also 

20 

indicates  I'm  getting  tired  --  beyond  the  scope 

21 

and  lacks  foundation. 

22 

THE  WITNESS:  Well,  you  can  read  the 
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words  that  are  on  the  page . 
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2 

BY  MS.  HANLEY  COOK: 

3 

Q  Do  the  words  on  this  page  indicate  to 

4 

you  why  Einstein  2  involves  the  creation  of  a 

5 

temporary  copy  of  the  traffic  being  scanned? 

6 

MR.  PATTON:  Same  objections. 

7 

THE  WITNESS:  Well,  it  says  it's  for 

8 

the  purpose  of  scanning  by  the  sensors.  I  guess 

9 

that's  not  the  why. 

10 

BY  MS.  HANLEY  COOK: 

11 

Q  Doesn't  Einstein  2  create  a  temporary 

12 

copy  of  the  traffic  being  scanned  so  that  it  will 

13 

not  disrupt  the  normal  operations  of  federal 

14 

systems? 

15 

MR.  PATTON:  Same  objections. 

16 

including  lack  of  foundation. 

17 

THE  WITNESS:  I'm  not  --  again,  in  my 

18 

personal  capacity,  having  done  work  on  this  in 

19 

previous  positions,  without  having  reviewed  all 

20 

those  documents,  I'm  not  willing  to  expound  one 

21 

way  or  the  other  on  the  particular  information 

22 

provided  here  beyond  what  you  see  on  the  piece  of 
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2 

BY  MS.  HANLEY  COOK: 

3 

Q  In  June  2015,  did  upstream 

4 

surveillance  involve  the  scanning  of  a  temporary 

5 

copy  of  the  transactions  scanned? 

6 

MR.  PATTON:  Objection,  calls  for 

7 

classified  information,  information  subject  to  the 

8 

statutory  privileges,  and  instruct  the  witness  not 

9 

to  answer. 

10 

THE  WITNESS:  I  will  follow  the 

11 

instructions . 

12 

BY  MS.  HANLEY  COOK: 

13 

Q  Going  back  several  hours  now  -- 

14 

A  Awesome. 

15 

Q  --  you  testified  I  think,  but  correct 

16 

me  if  I'm  wrong,  that  as  of  June  2015,  the  NSA 

17 

scanned  at  least  some  portions  of  the  application 

18 

layer  of  Internet  transactions  as  part  of  upstream 

19 

collection,  right? 

20 

MR.  PATTON:  Just  a  second. 

21 

(Counsel  conferring.) 

22 

MR.  PADGETT:  Can  you  read  the 
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1 

question? 

2 

(The  reporter  read  back  the  question.) 

3 

THE  WITNESS:  Can  we  go  off  the 

4 

record? 

5 

MS.  HANLEY  COOK:  Yeah,  thank  you. 

6 

(Off  the  record  at  10:06  p.m.) 

7 

(Resume  at  10:11  p.m.) 

8 

THE  WITNESS:  Can  you  repeat  your 

9 

sentence  one  more  time  to  make  sure  I  was 

10 

accurately 

--  or  can  you  repeat  what  you  -- 

11 

MS.  HANLEY  COOK:  Dawn,  do  you  mind 

12 

reading  it? 

Thanks . 

13 

(The  reporter  read  back  the  question.) 

14 

THE  WITNESS:  Yes,  that's  correct. 

15 

BY  MS.  HANLEY  COOK: 

16 

Q 

You  also  testified  that  deep  packet 

17 

inspection 

refers  to  the  scanning  of  the 

18 

application 

layer  of  Internet  packets,  right? 

19 

A 

In  the  general  --  oh. 

20 

MR.  PATTON:  Object  to  the  extent  it 

21 

may  mischaracterize  the  testimony,  and  beyond  the 

22 

scope,  but 

the  witness  can  answer. 
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2 

is  traditionally  understood  for  what  deep  packet 

3 

inspection  means,  not  specific  to  upstream. 

4 

BY  MS.  HANLEY  COOK: 

5 

Q  But  it's  accurate  then  to  say  that 

6 

upstream  surveillance,  as  of  June  2015,  involved 

7 

deep  packet  inspection,  right? 

8 

MR.  PATTON:  Just  a  moment. 

9 

(Counsel  conferring.) 

10 

MR.  PATTON:  Objection  as  to  vague. 

11 

beyond  the  scope  of  30(b) (6),  and  to  the  extent 

12 

there's  any  classified  information,  instruct  the 

13 

witness  not  to  answer. 

14 

If  there's  an  unclassified  answer  that 

15 

she  can  provide,  she  can  provide  that  now. 

16 

THE  WITNESS:  I  have  no  further 

17 

information.  I  will  take  the  instructions  and  not 

18 

provide  classified  information. 

19 

BY  MS.  HANLEY  COOK: 

20 

Q  Today,  how  many  targets  does  NSA  have 

21 

for  upstream  surveillance? 

22 

MR.  PATTON:  Objection,  calls  for 
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classified  information,  and  information  protected 
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2 

by  the  statutory  privileges,  instruct  not  to 

3 

answer . 

4 

THE  WITNESS:  Could  you  ask  the 

5 

question  again,  please? 

6 

BY  MS.  HANLEY  COOK: 

7 

Q  Sure.  Today  how  many  targets  does  NSA 

8 

have  for  upstream  surveillance? 

9 

MR.  PATTON:  Same  objection.  If  the 

10 

witness  is  aware  of  any  unclassified  answer,  we 

11 

should  probably  talk  about  that. 

12 

THE  WITNESS:  Okay,  why  don't  we  go 

13 

talk  about  that. 

14 

MR.  PATTON:  Off  the  record. 

15 

(Off  the  record  at  10:14  p.m.) 

16 

(Resume  at  10:14  p.m.) 

17 

MR.  PATTON:  Read  the  question  back. 

18 

please . 

19 

(The  reporter  read  back  the  question.) 

20 

MR.  PATTON:  Same  objections,  same 

21 

instructions . 

22 

THE  WITNESS:  I  will  follow  the 
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2 

BY  MS.  HANLEY  COOK: 

3 

Q  In  June  2015,  how  many  targets  did  NSA 

4 

have  for  upstream  surveillance? 

5 

MR.  PATTON:  Same  objection,  same 

6 

instruction . 

7 

THE  WITNESS:  I'll  follow  the 

8 

instructions . 

9 

BY  MS.  HANLEY  COOK: 

10 

Q  Without  revealing  the  --  you  good? 

11 

MR.  PATTON:  Yeah. 

12 

BY  MS.  HANLEY  COOK: 

13 

Q  Without  revealing  the  contents  of  any 

14 

conversations  that  you  had  with  your  attorneys 

15 

outside  this  room  today,  and  with  the  exception  of 

16 

conversations  related  to  determining  whether 

17 

classified  information  was  responsive  to  a 

18 

question,  where  the  line  was  properly  drawn  on 

19 

classified  information,  state  secret 

20 

classifications,  during  breaks  in  the  deposition 

21 

today,  did  you  discuss  with  anyone  the  substance 

22 

of  your  testimony  during  the  deposition? 
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MR.  PATTON:  Subject  to  those  caveats 
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2 

you  said,  plus  the  statutory  privileges,  the 

3 

witness  can  answer. 

4 

THE  WITNESS:  No. 

5 

MS.  HANLEY  COOK:  I  have  no  further 

6 

questions . 

7 

MR.  TOOMEY:  Can  we  take  a  break? 

8 

MS.  HANLEY  COOK:  Strike  that  I  said 

9 

that.  Take  a  break  for  five  minutes  to  be  sure. 

10 

just  go  back  through  the  outline. 

11 

(Off  the  record  at  10:16  p.m.) 

12 

(Resume  at  10:26  p.m.) 

13 

EURTHER  EXAMINATION 

14 

BY  MR.  TOOMEY: 

15 

Q  When  a  communication  is  encrypted 

16 

using  HTTPS,  does  some  of  the  communication's 

17 

metadata  remain  unencrypted? 

18 

MR.  PATTON:  One  second. 

19 

(Counsel  conferring.) 

20 

MR.  PATTON:  Object  to  the  question  as 

21 

beyond  the  scope  of  30(b)  (6),  calling  for  an 

22 

expert  opinion.  The  witness  can  answer  in  her 
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2 

of  the  answer. 

3 

THE  WITNESS:  In  the  general  sense,  it 

4 

will  depend  on  the  type  of  encryption  that's  being 

5 

used,  and  it  will  depend  on  the  nature  of  how  it's 

6 

being  transmitted,  so  there's  not  one  answer  that 

7 

fits  all. 

8 

BY  MR.  TOOMEY: 

9 

Q  So  when  a  communication  is  encrypted 

10 

using  HTTPS,  does  some  of  the  communication's 

11 

metadata  remain  unencrypted? 

12 

MR.  PATTON:  Object  to  the  term 

13 

"communication"  as  vague,  and  same  prior 

14 

objections  and  instruction  to  the  witness. 

15 

THE  WITNESS:  To  the  extent  that  the 

16 

question  is  somewhat  vague.  I'll  say  generally 

17 

speaking,  yes,  but  I  think  there  are  different 

18 

ways  you  could  do  things  that  might  change  that 

19 

answer . 

20 

BY  MR.  TOOMEY: 

21 

Q  When  a  communication  is  encrypted 

22 

using  HTTPS,  are  the  senders  and  recipients' 
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2 

MR.  PATTON:  Same  objection,  same 

3 

instruction . 

4 

THE  WITNESS:  Generally  speaking,  they 

5 

will  --  I'm  sorry,  say  the  question  one  more  time. 

6 

(The  reporter  read  back  the  question.) 

7 

MR.  PATTON:  Same  objection,  same 

8 

instruction . 

9 

THE  WITNESS:  Again,  the  question  is 

10 

somewhat  vague,  and  so  I  would  answer  generally 

11 

that  is  true,  but  there  are  undoubtedly  a  number 

12 

of  exceptions  that  also  could  make  that  untrue. 

13 

MR.  TOOMEY:  Could  you  please  mark 

14 

this  document  as  57. 

15 

(Deposition  Exhibit  57  was 

16 

marked  for  identification.) 

17 

BY  MR.  TOOMEY: 

18 

Q  Could  you  please  take  a  look  at  the 

19 

document,  describe  what  it  is,  and  tell  me  if 

20 

you're  familiar  with  it. 

21 

A  This  is  the  Notice  of  Eiling  of 

22 

Government's  Responses  to  EISC  Questions  Regarding 
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the  Amended  2011  Section  702  Certifications,  dated 

Page  355 

2 

November  15th,  2011. 

3 

Q  Thank  you. 

4 

A  Yes,  I  am  familiar  with  these 

5 

documents . 

6 

Q  Could  you  please  turn  to  page  9? 

7 

A  Sure . 

8 

Q  I'm  going  to  read  from  about  the  third 

9 

paragraph  down  in  the  middle  of  the  personal 

10 

knowledge,  which  says,  "Metadata  that  has  been 

11 

extracted  from  Internet  transactions  consistent 

12 

with  Section  3(b) (5) (b) (4)  is  subject  to  the 

13 

two-year  retention  limit  set  forth  in  Section  3  (c) 

14 

of  the  amended  NSA  minimization  procedures." 

15 

Was  that  statement  accurate  at  the 

16 

time  this  document  was  filed  with  the  FISC  on 

17 

November  I5th,  2011? 

18 

A  Yes . 

19 

Q  So  the  NSA  extracts  metadata  from 

20 

communications  collected  in  the  course  of  upstream 

21 

surveillance,  correct? 

22 

MR.  PATTON:  Just  a  moment. 
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(Counsel  conferring.) 
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2 

MR.  PATTON:  Objection,  vague  as  to 

3 

time  period,  but  the  witness  can  answer. 

4 

THE  WITNESS:  Could  you  ask  the 

5 

question  again? 

6 

(The  reporter  read  back  the  question.) 

7 

MR.  PATTON:  Objection,  vague  as  to 

8 

time . 

9 

THE  WITNESS:  So  I  would  just  offer 

10 

that  the  answer  to  your  question  is  metadata  has 

11 

been  extracted  from  the  Internet  transactions.  I 

12 

believe  that  the  question  said  communications,  in 

13 

which  case  that  would  be  consistent  with  the 

14 

information  that  was  provided  here. 

15 

BY  MR.  TOOMEY: 

16 

Q  So  I'll  rephrase. 

17 

The  NSA  extracts  metadata  from 

18 

Internet  transactions  collected  in  the  course  of 

19 

upstream  surveillance,  correct? 

20 

MR.  PATTON:  Objection,  vague  as  to 

21 

time . 

22 

THE  WITNESS:  Consistent  with  2011, 
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what's  written  here  at  2011,  yes,  that  is  true. 
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2 

BY  MR.  TOOMEY: 

3 

Q  Today,  the  NSA  retains  metadata 

4 

associated  with  its  targets'  communications  in  the 

5 

course  of  upstream  surveillance,  correct? 

6 

MR.  PATTON:  Hold  on. 

7 

(Counsel  conferring.) 

8 

MR.  PATTON:  Sorry,  could  you  read  the 

9 

question  back,  please? 

10 

(The  reporter  read  back  the  question.) 

11 

MR.  PATTON:  Object  to  the  question  to 

12 

the  extent  it  calls  for  classified  information  or 

13 

otherwise  privileged  pursuant  to  the 

14 

aforementioned  statutes. 

15 

If  there  is  an  unclassified  answer. 

16 

the  witness  can  provide  it. 

17 

THE  WITNESS:  Could  you  read  the 

18 

question  one  more  time? 

19 

(The  reporter  read  back  the  question.) 

20 

MR.  PATTON:  Same  objection,  same 

21 

instruction . 

22 

THE  WITNESS:  NSA  retains  —  I  would 
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2 

"communications,"  I  would  say  "Internet 

3 

transaction."  I  would  say  generally,  yes,  this  is 

4 

true . 

5 

BY  MR.  TOOMEY: 

6 

Q  Sorry,  I  didn't  hear  you.  Could  you 

7 

say  that  again? 

8 

A  Sure.  NSA  retains  metadata  --  may 

9 

retain  metadata  associated  with  Internet 

10 

transactions  in  the  course  of  upstream. 

11 

Q  The  NSA  has  an  interest  in  the 

12 

metadata  of  its  targets '  communications  or 

13 

Internet  transactions,  correct? 

14 

MR.  PATTON:  Objection  as  vague. 

15 

beyond  the  scope  of  30(b) (6) . 

16 

The  witness  can  answer. 

17 

THE  WITNESS:  NSA  is  interested  in  the 

18 

metadata  associated  with  the  Internet  transactions 

19 

of  a  targeted  selector  --  to  or  from  a  targeted 

20 

selector . 

21 

BY  MR.  TOOMEY: 

22 

Q  So  just  to  be  clear,  just  to  make  sure 
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I  understood  your  answer,  the  NSA  has  an  interest 
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2 

in  the  metadata  of  communications  to  and  from  a 

3 

targeted  selector? 

4 

MR.  PATTON:  Objection,  beyond  the 

5 

scope.  The  witness  can  answer. 

6 

THE  WITNESS:  Could  you  repeat  the 

7 

question? 

8 

(The  reporter  read  back  the  question.) 

9 

THE  WITNESS:  I  would  not  use  the  word 

10 

"communications."  I  would  use  the  word  "Internet 

11 

transactions . " 

12 

BY  MR.  TOOMEY: 

13 

Q  So  just  to  be  clear,  the  NSA  has  an 

14 

interest  in  the  metadata  of  Internet  transactions 

15 

to  and  from  a  targeted  selector? 

16 

MR.  PATTON:  Objection,  beyond  the 

17 

scope,  asked  and  answered. 

18 

THE  WITNESS:  Yes. 

19 

MR.  TOOMEY:  Thank  you.  All  right,  we 

20 

do  not  have  any  further  questions  right  now. 

21 

MR.  PATTON:  Before  we  get  off  the 

22 

record,  the  government  is  going  to  invoke  Eederal 
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Rule  of  Civil  Procedure  30  (e)  to  reserve  the  right 
to  review  and  signature  of  the  witness. 

(Whereupon,  at  10:36  p.m.,  the  taking 
of  the  deposition  was  concluded. 

Reading  and  signature  were  reserved.) 
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Wikimcdia  Foundation  v.  NSA,  ct  al.,  15-cv-00662-TSE  (D.  Md.) 
ERRATA  SHEET  of  REBECCA  J.  RICHARDS 


Faac 

Line 
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Spelling  Error 
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Michael  F. 
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Spelling  Error 
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telecom 
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Spelling  Error 

169 
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USA  FREEDOM  Act 

USA  Freedom 
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Capitalization 
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Protocol 
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Error 
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CERTIFICATE  OF  NOTARY  PUBLIC 
I,  DAWN  A.  JAQUES,  a  Notary  Public  in  and  for 
the  District  of  Columbia,  before  whom  the  foregoing 
deposition  was  taken,  do  hereby  certify  that  witness 
whose  testimony  appears  in  the  foregoing  pages  was 
duly  sworn  by  me;  that  the  testimony  of  said  witness 
was  taken  by  me  in  shorthand  at  the  time  and  place 
mentioned  in  the  caption  hereof  and  thereafter 
reduced  to  typewriting  under  my  supervision;  that 
said  deposition  is  a  true  record  of  the  testimony 
given  by  said  witness;  that  I  am  neither  counsel 
for,  related  to,  nor  employed  by  any  of  the  parties 
to  the  action  in  which  this  deposition  is  taken; 
and,  further,  that  I  am  not  a  relative  or  employee 
of  any  attorney  or  counsel  employed  by  the  parties 
thereto,  nor  financially  or  otherwise  interested  in 
the  outcome  of  the  actions. 


lawn  A.  Jaques,  CS^  ClJT 


Dawn  A.  Jaques,  CSR, 
Notary  Public  in  an 
District  of  Columbia 


C] 
for 


My  commission  expires: 
January  14,  2020 
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1 

***  ERRATA  SHEET  *** 

TRANSPEREECT  DEPOSITION  SERVICES 

2 

216  E.  45th  Street,  Suite 

#903 

NEW  YORK,  NEW  YORK  10017 

3 

(212)  400-8845 

4 

CASE:  WIKIMEDIA  EOUNDATION  v.  NATIONAL 
DATE:  APRIL  16,  2018 

SECURITY 

AGENCY,  et  al. 

5 

WITNESS:  REBECCA  J.  RICHARDS  REE: 

21368 

6 

PAGE  LINE  EROM  TO 

7 

1  1  1 

8 

1  1  1 
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1  1  1 

10 

1  1  1 

11 

1  1  1 

12 

1  1  1 

13 

1  1  1 

14 

1  1  1 

15 

1  1  1 

16 

17 

REBECCA  J.  RICHARDS 

18 

Subscribed  and  sworn  to  before  me 

19 

20 

this  day  of  ,  20  . 

21 

Notary  Public 

22 
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National  Security  Agency,  Civil  Liberties  and  Privacy  Office 

Report 

NSA’s  Implementation  of  Foreign  Intelligence  Surveillance  Act  Section  702 

April  16,2014 


INTRODUCTION 

This  report  was  prepared  by  the  National  Security  Agency  (NS A)  Civil  Liberties  and 
Privacy  Office  as  part  of  its  responsibilities  to  enhance  communications  and  transparency  with 
the  public  and  stakeholders.  Its  Director  is  the  primary  advisor  to  the  Director  of  NS  A  when  it 
comes  to  matters  of  civil  liberties  and  privacy.  Created  in  January  2014,  the  Office  is  also 
charged  with  ensuring  that  civil  liberties  and  privacy  protection  are  integrated  into  NSA 
activities.  The  intent  of  this  paper  is  to  help  build  a  common  understanding  that  can  serve  as  a 
foundation  for  future  discussions  about  the  existing  civil  liberties  and  privacy  protections. 

The  mission  of  NSA  is  to  make  the  nation  safer  by  providing  policy  makers  and  military 
commanders  with  timely  foreign  intelligence  and  by  protecting  national  security  information 
networks.  NSA  collects  foreign  intelligence  based  on  requirements  from  the  President,  his 
national  security  team,  and  their  staffs  through  the  National  Intelligence  Priorities  Framework. 
NSA  fulfills  these  national  foreign  intelligence  requirements  through  the  collection,  processing, 
eind  analysis  of  communications  or  other  data,  passed  or  accessible  by  radio,  wire  or  other 
electronic  means. 

NSA’s  authority  to  conduct  signals  intelligence  collection  for  foreign  intelligence  and 
counterintelligence  purposes  is  provided  primarily  by  Section  1.7(c)(1)  of  Executive  Order 
12333,  as  amended.  The  execution  of  NSA's  signals  intelligence  mission  must  be  conducted  in 
conformity  with  the  Fourth  Amendment.  This  includes  NSA's  acquisition  of  communications  to 
which  a  U.S.  person  is  a  party  under  circumstances  in  which  the  U.S.  person  has  a  reasonable 
expectation  of  privacy.  The  Foreign  Intelligence  Surveillance  Act  of  1978  (FISA)  further 
regulates  certain  types  of  foreign  intelligence  collection,  including  that  which  occurs  with 
compelled  assistance  from  U.S.  communications  providers. 

This  Report  describes  one  way  in  which  NSA  meets  these  responsibilities  while  using 
Section  702  of  FISA,  as  amended  by  the  FISA  Amendments  Act  of  2008.  Although  multiple 
federal  agencies  participate  in  Section  702  collection,  this  paper  describes  the  process  by  which 
NSA  obtains,  uses,  shares,  and  retains  communications  of  foreign  intelligence  value  pursuant  to 
Section  702.  It  also  describes  existing  privacy  and  civil  liberties  protections  built  into  the 
process. 
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The  NSA  Civil  Liberties  and  Privacy  Office  (CLPO)  used  the  Fair  Information  Practice 
Principles  (FIPP)'  as  an  initial  tool  to  describe  the  existing  civil  liberties  and  privacy  protections 
in  place  for  collection  done  under  Section  702  authority.^ 


SECTION  702  OF  FISA 


Section  702  of  FISA  was  widely  and  publicly  debated  in  Congress  both  during  the  initial 
passage  in  2008  and  the  subsequent  re-authorization  in  2012.  It  provides  a  statutory  basis  for 
NSA,  with  the  compelled  assistance  of  electronic  communication  service  providers,  to  target 
non-U. S.  persons  reasonably  believed  to  be  located  outside  the  U.S.  in  order  to  acquire  foreign 
intelligence  information.  Given  that  Section  702  only  allows  for  the  targeting  of  non-U. S. 
persons  outside  the  U.S.,  it  differs  from  most  other  sections  of  FISA.  It  does  not  require  an 
individual  determination  by  the  U.S.  Foreign  Intelligence  Surveillance  Court  (FISC)  that  there  is 
probable  cause  to  believe  the  target  is  a  foreign  power  or  an  agent  of  a  foreign  power.  Instead, 
the  FISC  reviews  annual  topical  certifications  executed  by  the  Attorney  General  (AG)  and  the 
Director  of  National  Intelligence  (DNI)  to  determine  if  these  certifications  meet  the  statutory 
requirements.  The  FISC  also  determines  whether  the  statutorily  required  targeting  and 
minimization  procedures  used  in  connection  with  the  certifications  are  consistent  with  the  statute 
and  the  Fourth  Amendment.  The  targeting  procedures  are  designed  to  ensure  that  Section  702  is 
only  used  to  target  non-U. S.  persons  reasonably  believed  to  be  located  outside  the  U.S. 

The  minimization  procedures  are  designed  to  minimize  the  impact  on  the  privacy  on  U.S. 
persons  by  minimizing  the  acquisition,  retention,  and  dissemination  of  non-publicly  available 
U.S.  person  information  that  was  lawfully,  but  incidentally  acquired  under  Section  702  by  the 
targeting  of  non-U. S.  persons  reasonably  believed  to  be  located  outside  the  U.S.  Under  these 
certifications  the  AG  and  the  DNI  issue  directives  to  electronic  communication  service  providers 
(service  providers)  that  require  these  service  providers  to  “immediately  provide  the  Government 
with  all  information  ...  or  assistance  necessary  to  accomplish  the  acquisition  [of  foreign 
intelligence  information]  in  a  manner  that  will  protect  the  secrecy  of  the  acquisition....”  The 
Government’s  acquisition  of  communications  under  its  Section  702  authority  thus  takes  place 
pursuant  to  judicial  review  and  with  the  knowledge  of  the  service  providers. 

NSA  cannot  intentionally  use  Section  702  authority  to  target  any  U.S.  citizen,  any  other 
U.S.  person,  or  anyone  known  at  the  time  of  acquisition  to  be  located  within  the  U.S.  The  statute 
also  prohibits  the  use  of  Section  702  to  intentionally  acquire  any  communication  as  to  which  the 


'  The  FIPPS  are  the  recognized  principles  for  assessing  privacy  impacts.  They  have  been  incorporated  into 
EO 13636,  Improving  Critical  Infrastructure  Cybersecurity  and  the  National  Strategy  for  Trusted  Identities  in 
Cyberspace.  These  principles  are  rooted  in  the  U.S.  Department  of  Health,  Education  and  Welfare’s  seminal  1973 
report,  “Records,  Computers  and  the  Rights  of  Citizens.”  The  FlPPs  have  been  implemented  in  the  Privacy  Act  of 
1 974,  with  certain  exemptions,  including  ones  that  apply  to  certain  national  security  and  law  enforcement  activities. 

^  NSA  CLPO  will  continue  to  refine  its  assessment  tools  to  best  suit  the  mission  of  NSA,  as  a  member  of  the 
Intelligence  Community,  and  to  protect  civil  liberties  and  privacy. 
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sender  and  all  intended  recipients  are  known  at  the  time  of  acquisition  to  be  located  inside  the 
U.S.  Similarly,  the  statute  prohibits  the  use  of  Section  702  to  conduct  “reverse  targeting”  (i.e., 
NSA  may  not  intentionally  target  a  person  reasonably  believed  to  be  located  outside  of  the  U.S. 
if  the  purpose  of  such  acquisition  is  to  target  a  person  reasonably  believed  to  be  located  inside 
the  U.S.).  All  acquisitions  conducted  pursuant  to  Section  702  must  be  conducted  in  a  manner 
consistent  with  the  Fourth  Amendment.  NSA’s  FISC-approved  targeting  procedures  permit 
NSA  to  target  a  non-U. S.  person  reasonably  believed  to  be  located  outside  the  U.S.  if  the 
intended  target  possesses,  is  expected  to  receive,  and/or  is  likely  to  communicate  foreign 
intelligence  information  concerning  one  of  the  certifications  executed  by  the  AG  and  DNI. 
Although  the  purpose  of  Section  702  is  to  authorize  targeting  of  non-U. S.  persons  outside  the 
U.S.,  the  statute’s  requirement  for  minimization  procedures  recognizes  that  such  targeted 
individuals  or  entities  may  communicate  about  U.S.  persons  or  with  U.S.  persons.  For  this 
reason,  NSA  also  must  follow  FISC-approved  minimization  procedures  that  govern  the  handling 
of  any  such  communications. 


NSA  must  report  to  the  Office  of  the  Director  of  National  Intelligence  (ODNl)  and  the 
Department  of  Justice  (DOJ)  any  and  all  instances  where  it  has  failed  to  comply  with  the 
targeting  and/or  minimization  procedures.  In  addition,  ODNI  and  DOJ  have  access  to 
documentation  concerning  each  of  NSA’s  Section  702  targeting  decisions  and  conduct  regular 
reviews  in  order  to  provide  independent  oversight  of  NSA’s  use  of  the  authority.  The  FISC 
Rules  of  Procedure  require  the  Government  to  notify  the  Court  of  all  incidents  of  non- 
compliance  with  applicable  law  or  with  an  authorization  granted  by  the  Court.  The  Government 
reports  Section  702  compliance  incidents  to  the  Court  via  individual  notices  and  quarterly 
reports.  In  addition,  the  Government  reports  all  Section  702  compliance  incidents  to  Congress  in 
the  Attorney  General’s  Semiannual  Report.  Depending  on  the  type  or  severity  of  compliance 
incident,  NSA  may  also  promptly  notify  the  Congressional  Intelligence  Committees,  as  well  as 
the  President’s  Intelligence  Oversight  Board  of  an  individual  compliance  matter. 

Existing  Privacy  and  Civil  Liberties  Protections:  Each  of  the  three  branches  of  federal 
government  oversees  NSA’s  use  of  the  Section  702  authorities.  NSA  provides  transparency  to 
its  oversight  bodies  (Congress,  DOJ,  ODNI,  DoD,  the  President’s  Intelligence  Oversight  Board 
and  the  FISC)  through  regular  briefings,  court  filings,  and  incident  reporting.  In  addition,  DOJ 
and  ODNI  conduct  periodic  reviews  of  NSA’s  use  of  the  authority  and  report  on  those  reviews. 
More  recently,  at  the  direction  of  the  President,  the  Government  has  provided  additional 
transparency  to  the  public  regarding  the  program  by  declassifying  FISC  opinions  and  related 
documents.  Although  FISA  surveillance  is  normally  kept  secret  from  the  targets  of  the 
surveillance,  there  are  exceptions.  For  example,  if  the  Government  intends  to  use  the  results  of 
FISA  surveillance,  to  include  Section  702  surveillance,  in  a  trial  or  other  proceeding  against  a 
person  whose  communications  were  collected,  the  Government  must  notify  the  person  so  the 
person  can  challenge  whether  the  communications  were  acquired  lawfully.  These  protections 
implement  the  general  Fair  Information  Practice  Principle  (FIPP)  of  transparency. 
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HOW  NSA  IMPLEMENTS  SECTION  702  of  FISA 


TRAINING 

Before  an  analyst  gains  access  to  any  NSA  signals  intelligence  data,  the  analyst  must 
complete  specialized  training  on  the  legal  and  policy  guidelines  that  govern  the  handling  and  use 
of  the  data.  Additional  training  is  required  for  access  to  Section  702  data.  These  armual 
mandatory  training  requirements  include  scenario-based  training,  required  reading,  and  a  final 
competency  test.  The  analyst  must  pass  this  test  before  being  granted  access.  Furthermore,  if  a 
compliance  incident  involves  a  mistake  or  misunderstanding  of  relevant  policies,  the  analyst  is 
re-trained  in  order  to  continue  to  have  access  to  the  data  acquired  pursuant  to  Section  702. 

IDENTIFYING  AND  TASKING  A  SELECTOR 

Next  in  the  Section  702  process  is  for  an  NSA  analyst  to  identify  a  non-U. S.  person 
located  outside  the  U.S.  who  has  and/or  is  likely  to  communicate  foreign  intelligence 
information  as  designated  in  a  certification.  For  example,  such  a  person  might  be  an  individual 
who  belongs  to  a  foreign  terrorist  organization  or  facilitates  the  activities  of  that  organization’s 
members.  Non-U. S.  persons  are  not  targeted  unless  NSA  has  reason  to  believe  that  they  have 
and/or  are  likely  to  communicate  foreign  intelligence  information  as  designated  in  a  certification; 
U.S.  persons  are  never  targeted. 

Once  the  NSA  analyst  has  identified  a  person  of  foreign  intelligence  interest  who  is  an 
appropriate  target  under  one  of  the  FISC-approved  Section  702  certifications,  that  person  is 
considered  the  target.  The  NSA  analyst  attempts  to  determine  how,  when,  with  whom,  and 
where  the  target  communicates.  Then  the  analyst  identifies  specific  communications  modes  used 
by  the  target  and  obtains  a  unique  identifier  associated  with  the  target  —  for  example,  a  telephone 
number  or  an  email  address.  This  unique  identifier  is  referred  to  as  a  selector.  The  selector  is 
not  a  “keyword”  or  particular  term  (e.g.,  “nuclear”  or  “bomb”),  but  must  be  a  specific 
communications  identifier  (e.g.,  e-mail  address). 

Next  the  NSA  analyst  must  verify  that  there  is  a  connection  between  the  target  and  the 
selector  and  that  the  target  is  reasonably  believed  to  be  (a)  a  non-U. S.  person  and  (b)  located 
outside  the  U.S.  This  is  not  a  51%  to  49%  “foreignness”  test.  Rather  the  NSA  analyst  will  check 
multiple  sources  and  make  a  decision  based  on  the  totality  of  the  information  available.  If  the 
analyst  discovers  any  information  indicating  the  targeted  person  may  be  located  in  the  U.S.  or 
that  the  target  may  be  a  U.S.  person,  such  information  must  be  considered.  In  other  words,  if 
there  is  conflicting  information  about  the  location  of  the  person  or  the  status  of  the  person  as  a 
non-U. S.  person,  that  conflict  must  be  resolved  before  targeting  can  occur. 

For  each  selector,  the  NSA  analyst  must  document  the  following  information:  (1)  the 
foreign  intelligence  information  expected  to  be  acquired,  as  authorized  by  a  certification.  (2)  the 
information  that  would  lead  a  reasonable  person  to  conclude  the  selector  is  associated  with  a 
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non-U. S.  person,  and  (3)  the  information  that  would  similarly  lead  a  reasonable  person  to 
conclude  that  this  non-U. S.  person  is  located  outside  the  U.S.  This  documentation  must  be 
reviewed  and  approved  or  denied  by  two  senior  NS  A  analysts  who  have  satisfied  additional 
training  requirements.  The  senior  NS  A  analysts  may  ask  for  more  documentation  or 
clarification,  but  regardless  must  verify  that  all  requirements  have  been  met  in  full.  NSA  tracks 
the  submission,  review,  and  approval  process  through  the  documentation  and  the  senior  NSA 
analysts’  determinations  are  retained  for  further  review  by  NSA’s  compliance  elements,  as  well 
as  external  oversight  reviewers  from  DOJ  and  ODNl.  Upon  approval,  the  selector  may  be  used 
as  the  basis  for  compelling  a  service  provider  to  forward  communications  associated  with  the 
given  selector.  This  is  generally  referred  to  as  “tasking”  the  selector. 


Existing  Privacy  and  Civil  Liberties  Protections:  NSA  trains  its  analysts  extensively  through  a 
variety  of  means  to  ensure  that  analysts  fully  understand  their  responsibilities  and  the  specific 
scope  of  this  authority.  If  the  analyst  fails  to  meet  the  training  standards,  the  analyst  will  not 
have  the  ability  to  use  the  Section  702  authority  for  collection  purposes.  If  the  analyst  fails  to 
maintain  ongoing  training  standards,  the  analyst  will  lose  the  ability  to  use  the  Section  702 
authority  for  collection  purposes  and  all  ability  to  retrieve  any  data  previously  collected  under 
the  authority.  NSA  requires  any  authorized  and  trained  analyst  seeking  to  task  a  selector  using 
Section  702  to  document  the  three  requirements  for  use  of  the  authority  -  that  the  target  is 
connected  sufficiently  to  the  selector  for  an  approved  foreign  intelligence  purpose,  that  the  target 
is  a  non-U. S.  person,  and  that  the  target  is  reasonably  believed  to  be  located  outside  the  U.S. 

This  documentation  must  be  reviewed,  validated,  and  approved  by  the  senior  analysts  who  have 
received  additional  training.  These  protections  implement  the  general  FIPPs  of  purpose 
specification,  accountability  and  auditing,  and  minimization. 


ACCESSING  AND  ASSESSING  COMMUNICATIONS  OBTAINED  UNDER  SECTION 
702  AUTHORITY 


Once  senior  analysts  have  approved  a  selector  as  compliant,  the  service  providers  are 
legally  compelled  to  assist  the  government  by  providing  the  relevant  communications.  Therefore, 
tasking  under  this  authority  takes  place  with  the  knowledge  of  the  service  providers.  NSA 
receives  information  concerning  a  tasked  selector  through  two  different  methods. 

In  the  first,  the  Government  provides  selectors  to  service  providers  through  the  FBI.  The 
service  providers  are  compelled  to  provide  NSA  with  communications  to  or  from  these  selectors. 
This  has  been  generally  referred  to  as  the  PRISM  program. 

In  the  second,  service  providers  are  compelled  to  assist  NSA  in  the  lawful  interception  of 
electronic  communications  to,  from,  or  about  tasked  selectors.  This  type  of  compelled  service 
provider  assistance  has  generally  been  referred  to  as  Upstream  collection.  NSA’s  FISC- 
approved  targeting  procedures  include  additional  requirements  for  such  collection  designed  to 
prevent  acquisitions  of  wholly  domestic  communications.  For  example,  in  certain  circumstances 
NSA’s  procedures  require  that  it  employ  an  Internet  Protocol  filter  to  ensure  that  the  target  is 
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located  overseas.  The  process  for  approving  the  selectors  for  tasking  is  the  same  for  both 
PRISM  and  Upstream  collection. 


Once  NSA  has  received  communications  of  the  tasked  selector,  NSA  must  follow 
additional  FISC-approved  procedures  known  as  the  minimization  procedures.  These  procedures 
require  NSA  analysts  to  review  at  least  a  sample  of  communications  acquired  from  all  selectors 
tasked  under  Section  702,  which  occurs  on  a  regular  basis  to  verify  that  the  reasonable  belief 
determination  used  for  tasking  remains  valid. 

The  NSA  analyst  must  review  a  sample  of  communications  received  from  the  selectors  to 
ensure  that  they  are  in  fact  associated  with  the  foreign  intelligence  target  and  that  the  targeted 
individual  or  entity  is  not  a  U.S.  person  and  is  not  currently  located  in  the  U.S.  If  the  NSA 
analyst  discovers  that  NSA  is  receiving  communications  that  are  not  in  fact  associated  with  the 
intended  target  or  that  the  user  of  a  tasked  selector  is  determined  to  be  a  U.S.  person  or  is  located 
in  the  U.S.,  the  selector  must  be  promptly  “detasked.”  As  a  general  rule,  in  the  event  that  the 
target  is  a  U.S.  person  or  in  the  U.S.,  all  other  selectors  associated  with  the  target  also  must  be 
detasked. 


Existing  Privacy  and  Civil  Liberties  Protections:  In  addition  to  extensive  training,  the  analyst  is 
required  to  review  the  collection  to  determine  that  it  is  associated  with  the  targeted  selector  and 
is  providing  the  expected  foreign  intelligence  shortly  after  the  tasking  starts  and  at  least  annually 
thereafter.  This  review  allows  NSA  to  identify  possible  problems  with  the  collection  and 
provides  an  additional  layer  of  accountability.  In  addition,  NSA  has  technical  measures  that  alert 
the  NSA  analysts  if  it  appears  a  selector  is  being  used  from  the  U.S.  These  protections  implement 
the  general  FIPPs  of  purpose  specification,  minimization,  accountability  and  auditing,  data 
quality,  and  security. 

NSA  PROCESSING  AND  ANALYSIS  OF  COMMUNICATIONS  OBTAINED  UNDER 
SECTION  702  AUTHORITY 

Communications  provided  to  NSA  under  Section  702  are  processed  and  retained  in 
multiple  NSA  systems  and  data  repositories.  One  data  repository,  for  e,\ample,  might  hold  the 
contents  of  communications  such  as  the  texts  of  emails  and  recordings  of  conversations,  while 
another,  may  only  include  metadata,  i.e.,  basic  information  about  the  communication,  such  as  the 
time  and  duration  of  a  telephone  call,  or  sending  and  receiving  email  addresses. 

NSA  analysts  may  access  communications  obtained  under  Section  702  authority  for  the 
purpose  of  identifying  and  reporting  foreign  intelligence.  They  access  the  information  via 
“queries,”  which  may  be  date-bound,  and  may  include  alphanumeric  strings  such  as  telephone 
numbers,  email  addresses,  or  terms  that  can  be  used  individually  or  in  combination  with  one 
another.  FISC-approved  minimization  procedures  govern  any  queries  done  on  Section  702- 
derived  information.  NSA  analysts  with  access  to  Section  702-derived  information  are  trained  in 
the  proper  construction  of  a  query  so  that  the  query  is  reasonably  likely  to  return  valid  foreign 
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intelligence  and  minimizes  the  likelihood  of  returning  non-pertinent  U.S.  person  information. 
Access  by  NS  A  analysts  to  each  repository  is  controlled,  monitored,  and  audited.  There  are,  for 
example,  automated  checks  to  determine  if  an  analyst  has  completed  all  required  training  prior  to 
returning  information  responsive  to  a  query.  Further,  periodic  spot  checks  on  queries  by  NS  A 
analysts  are  conducted. 

Since  October  201 1  and  consistent  with  other  agencies’  Section  702  minimization 
procedures,  NSA’s  Section  702  minimization  procedures  have  permitted  NS  A  personnel  to  use 
U.S.  person  identifiers  to  query  Section  702  collection  when  such  a  query  is  reasonably  likely  to 
return  foreign  intelligence  information.  NSA  distinguishes  between  queries  of  communications 
content  and  communications  metadata.  NSA  analysts  must  provide  justification  and  receive 
additional  approval  before  a  content  query  using  a  U.S.  person  identifier  can  occur.  To  date, 

NSA  analysts  have  queried  Section  702  content  with  U.S.  person  identifiers  less  frequently  than 
Section  702  metadata.  For  example,  NSA  may  seek  to  query  a  U.S.  person  identifier  when  there 
is  an  imminent  threat  to  life,  such  as  a  hostage  situation.  NSA  is  required  to  maintain  records  of 
U.S.  person  queries  and  the  records  are  available  for  review  by  both  DOJ  and  ODNI  as  part  of 
the  external  oversight  process  for  this  authority.  Additionally,  NSA’s  procedures  prohibit  NSA 
from  querying  Upstream  data  with  U.S.  person  identifiers. 

Existing  Privacy  and  Civil  Liberties  Protections:  In  addition  to  the  training  and  access  controls, 
NSA  maintains  audit  trails  for  all  queries  of  the  Section  702  data.  NSA’s  Signals  Intelligence 
Directorate’s  compliance  staff  routinely  reviews  a  portion  of  all  queries  that  include  U.S.  person 
identifiers  to  ensure  that  all  such  queries  are  only  conducted  when  appropriate.  Personnel  from 
DOJ  and  ODNI  provide  an  additional  layer  of  oversight  to  ensure  that  NSA  is  querying  the  data 
appropriately.  These  protections  implement  the  general  FlPPs  of  security,  accountability  and 
auditing,  and  data  quality. 

NSA  DISSEMINATION  OF  INTELLIGENCE  DERIVED  FROM  COMMUNICATIONS 
OBTAINED  UNDER  SECTION  702  AUTHORITY 

NSA  only  generates  signals  intelligence  reports  when  the  information  meets  a  specific 
intelligence  requirement,  regardless  of  whether  the  proposed  report  contains  U.S.  person 
information.  Dissemination  of  information  about  U.S.  persons  in  any  NSA  foreign  intelligence 
report  is  expressly  prohibited  unless  that  information  is  necessary  to  understand  foreign 
intelligence  information  or  assess  its  importance,  contains  evidence  of  a  crime,  or  indicates  a 
threat  of  death  or  serious  bodily  injury.  Even  if  one  or  more  of  these  conditions  apply,  NSA  may 
include  no  more  than  the  minimum  amount  of  U.S.  person  information  necessary  to  understand 
the  foreign  intelligence  or  to  describe  the  crime  or  threat.  For  example,  NSA  typically  “masks” 
the  true  identities  of  U.S.  persons  through  use  of  such  phrases  as  “a  U.S.  person”  and  the 
suppression  of  details  that  could  lead  to  him  or  her  being  successfully  identified  by  the  context. 
Recipients  of  NSA  reporting  can  request  that  NSA  provide  the  true  identity  of  a  masked  U.S. 
person  referenced  in  an  intelligence  report  if  the  recipient  has  a  legitimate  need  to  know  the 
identity.  Under  NSA  policy,  NSA  is  allowed  to  unmask  the  identity  only  under  certain 
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conditions  and  where  specific  additional  controls  are  in  place  to  preclude  its  further 
dissemination,  and  additional  approval  has  been  provided  by  one  of  seven  designated  positions  at 
NSA.  Additionally,  together  DOJ  and  ODNI  review  the  vast  majority  of  disseminations  of 
information  about  U.S.  persons  obtained  pursuant  to  Section  702  as  part  of  their  oversight 
process. 


Existing  Privacy  and  Civil  Liberties  Protections:  As  noted  above,  NSA  only  generates  signals 
intelligence  reports  when  the  information  meets  a  specific  intelligence  requirement,  regardless  of 
whether  the  proposed  report  contains  U.S.  person  information  or  not.  Additionally,  NSA’s 
Section  702  minimization  procedures  require  any  U.S.  person  information  to  be  minimized  prior 
to  dissemination,  thereby  reducing  the  impact  on  privacy  for  U.S.  persons.  The  information  may 
only  be  unmasked  in  specific  instances  consistent  with  the  minimization  procedures  and  NSA 
policy.  These  protections  implement  the  general  FlPPs  of  minimization  and  purpose 
specification. 


RETENTION  OF  UNEVALUATED  COMMUNICATIONS  OBTAINED  UNDER 
SECTION  702  AUTHORITY 

The  maximum  time  that  specific  communications’  content  or  metadata  may  be  retained 
by  NSA  is  established  in  the  FISC-approved  minimization  procedures.  The  unevaluated  content 
and  metadata  for  PRISM  or  telephony  data  collected  under  Section  702  is  retained  for  no  more 
than  five  years.  Upstream  data  collected  from  Internet  activity  is  retained  for  no  more  than  two 
years.  NSA  complies  with  these  retention  limits  through  an  automated  process. 

NSA’s  procedures  also  specify  several  instances  in  which  NSA  must  destroy  U.S.  person 
collection  promptly  upon  recognition.  In  general,  these  include  any  instance  where  NSA 
analysts  recognize  that  such  collection  is  clearly  not  relevant  to  the  authorized  purpose  of  the 
acquisition  nor  includes  evidence  of  a  crime.  Additionally,  absent  limited  exceptions,  NSA  must 
destroy  any  communications  acquired  when  any  user  of  a  tasked  account  is  found  to  have  been 
located  in  the  U.S.  at  the  time  of  acquisition. 

Existing  Privacy  and  Civil  Liberties  Protections:  NSA  has  policies,  technical  controls,  and  staff 
in  place  to  ensure  the  data  is  retained  in  accordance  with  the  FISC-approved  procedures.  The 
automated  process  to  delete  the  collection  at  the  end  of  the  retention  period  applies  to  both  U.S. 
person  and  non  U.S.  person  the  information.  There  is  an  additional  manual  process  for  the 
destroying  information  related  to  U.S.  Persons  where  NSA  analysts  have  recognized  the 
collection  is  clearly  not  relevant  to  the  authorized  purpose  of  the  acquisition  nor  includes 
evidence  of  a  crime.  These  protections  implement  the  general  FTPPs  of  minimization  and 
security. 
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ORGANIZATIONAL  MANAGEMENT,  COMPLIANCE,  AND  OVERSIGHT 


NSA  is  subject  to  rigorous  internal  compliance  and  external  oversight.  Like  many  other 
regulated  entities,  NSA  has  an  enterprise-wide  compliance  program,  led  by  NSA’s  Director  of 
Compliance,  a  position  required  by  statute.  NSA’s  compliance  program  is  designed  to  provide 
precision  in  NSA’s  activities  to  ensure  that  they  are  consistently  conducted  in  accordance  with 
law  and  procedure,  including  in  this  case  the  Section  702  certifications  and  accompanying 
Section  702  targeting  and  minimization  procedures  and  additional  FISC  requirements.  As  part  of 
the  enterprise-wide  compliance  structure,  NSA  has  compliance  elements  throughout  its  various 
organizations.  NSA  also  seeks  to  detect  incidents  of  non-compliance  at  the  earliest  point 
possible.  When  issues  of  non-compliance  arise  regarding  the  way  in  which  NSA  carries  out  the 
FISC-approved  collection,  NSA  takes  corrective  action  and,  in  parallel,  NSA  must  report 
incidents  of  non-compliance  to  ODNI  and  DOJ  for  further  reporting  to  the  FISC  and  Congress, 
as  appropriate  or  required. 

These  organizations,  along  with  the  NSA  General  Counsel,  the  NSA  Inspector  General, 
and  most  recently  the  Director  of  Civil  Liberties  and  Privacy  have  critical  roles  in  ensuring  all 
NSA  operations  proceed  in  accordance  with  the  laws,  policies,  and  procedures  governing 
intelligence  activities.  Additionally,  each  individual  NSA  analyst  has  a  responsibility  for 
ensuring  that  his  or  her  personal  activities  are  similarly  compliant.  Specifically,  this 
responsibility  includes  recognizing  and  reporting  all  situations  in  which  he  or  she  may  have 
exceeded  his  or  her  authority  to  obtain,  analyze,  or  report  intelligence  information  under  Section 
702  authority. 

Compliance:  NSA  reports  all  incidents  in  which,  for  example,  it  has  or  may  have 
inappropriately  queried  the  Section  702  data,  or  in  which  an  analyst  may  have  made 
typographical  errors  or  dissemination  errors.  NSA  personnel  are  obligated  to  report  when  they 
believe  NSA  is  not,  or  may  not  be,  acting  consistently  with  law,  policy,  or  procedure.  If  NSA  is 
not  acting  in  accordance  with  law,  policy,  or  procedure,  NSA  will  report  through  its  internal  and 
external  intelligence  oversight  channels,  conduct  reviews  to  understand  the  root  cause,  and  make 
appropriate  adjustments  to  its  procedures. 

If  NSA  discovers  that  it  has  tasked  a  selector  that  is  used  by  a  person  in  the  U.S.  or  by  a 
U.S.  person,  then  NSA  must  cease  collection  immediately  and,  in  most  cases  must  also  delete  the 
relevant  collected  data  and  cancel  or  revise  any  disseminated  reporting  based  on  this  data.  NSA 
encourages  self-reporting  by  its  personnel  and  seeks  to  remedy  any  errors  with  additional 
training  or  other  measures  as  necessary.  Following  an  incident,  a  range  of  remedies  may  occur: 
admonishment,  written  explanation  of  the  offense,  request  to  acknowledge  a  training  point  that 
the  analyst  might  have  missed  during  training,  and/or  required  retesting.  In  addition  to  reporting 
described  above,  any  intentional  violation  of  law  would  be  referred  to  the  NSA  Office  of 
Inspector  General.  To  date  there  have  been  no  such  instances,  as  most  recently  confirmed  by  the 
President’s  Review  Group  on  Intelligence  and  Communications  Technology. 
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External  Oversight:  As  required  by  the  Section  702  targeting  procedures,  both  DOJ  and 
ODNI  conduct  routine  oversight  reviews.  Representatives  from  both  agencies  visit  NS  A  on  a  bi¬ 
monthly  basis.  They  examine  all  tasking  datasheets  that  NSA  provides  to  DOJ  and  ODNI  to 
determine  whether  the  tasking  sheets  meet  the  documentation  standards  required  by  NSA’s 
targeting  procedures  and  provide  sufficient  information  for  the  reviewers  to  ascertain  the  basis 
for  NSA’s  foreignness  determinations.  For  those  records  that  satisfy  the  standards,  no  additional 
documentation  is  requested.  For  those  records  that  warrant  further  review,  NSA  provides 
additional  information  to  DOJ  and  ODNI  during  or  following  the  onsite  review.  NSA  receives 
feedback  from  the  DOJ  and  ODNI  team  and  incorporates  this  information  into  formal  and 
informal  training  to  analysts.  DOJ  and  ODNI  also  review  the  vast  majority  of  disseminated 
reporting  that  includes  U.S.  person  information. 

Existing  Privacy  and  Civil  Liberties  Protections:  The  compliance  and  oversight  processes 
allow  NSA  to  identify  any  concerns  or  problems  early  in  the  process  so  as  to  minimize  the 
impact  on  privacy  and  civil  liberties.  These  protections  implement  the  general  FlPPs  of 
transparency  to  oversight  organizations  and  accountability  and  auditing. 

CONCLUSION 

This  Report,  prepared  by  NSA’s  Office  of  Civil  Liberties  and  Privacy,  provides  a  comprehensive 
description  of  NSA’s  Section  702  activities.  The  report  also  documents  current  privacy  and  civil 
liberties  protections. 
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Tlie  Honorable  John  D.  Batc.s 

United  States  Foreign  Intelligence  Surveillance  Court 

333  Constitution  Avenue,  N.W. 

Washington,  D.C.  20001 

Re:  Clarification  of  National  Security  Agencys 

Upstream  Collection  Pursuant  to  Section  702  of 
FISA 

Dear  Judge  Bates: 


On  April  21,  2011,  tlie  National  Security  Agency  (NSA)  provided  the  National  Security 
Division  (NS.D)  and  the  Office  of  the  Director  of  National  Lrlelligence  (ODNI)  information 
clarifying  the  mamier  in  wliich  NSA  acquires  certain  coimnunications  through  its  upstream 
collection  platfonns  pursuant  to  Section  702  of  tlie  Foreign  hitelligence  Surveillance  Act  of 
1978,  as  amended  (FISA).  Altliough  NSA,  NSD,  and  ODNI  are  still  reviewing  this  matter  and 
assessing  its  import,  we  are  providing  preliminary  notice  at  this  time  pursuant  to  Rule  13(a)  of 
the  Rules  of  Procedure  for  the  Foreign  Intelligence  Surveillance  Court,  effective  November  1, 
2010,  in  order  provide  the  Court  with  tliis  additional  clarifying  information.  We  have  worked 
closely  in  these  efforts  with  NSA  officials,  who  have  assisted  in  drafting  and  reviewing  tins 
notice  to  the  Court. 


ISee.  e.g,,  DNI/AG 


As  previously  described  to  the  Court,  in  conducting  upstream  collection  using  electronic 
connnunication  accounts/addresses/identifiers  (hereinafter  "selectors")  pursuant  to  Section  702, 
NSA  acquires  hitemet  communications  tlrat  are  to  or  fi'oni  a  tasked  selector,  or  wliich  contain  a 
reference  to  a  tasked  selector.  The  term  "Internet  communications,"  as  described  by  the  Director 
of  NSA  in  affidavits  supporting  DNI/AG  7Q2(g)  certifications,  "is  intended  to  include  electfouic 
communications  th 
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Based  on  recent  discussions  among  NSA,  NSD,  and  ODNI  regarding  one 
specified  category  of  Internet  conmiunications  acquired  through  unstream  collection 
"electronic  comnimiications  j _ 

m  ' — and  in  view  of  the  complexity  of  tliis  issue  and  the  prior  representations  to  the  Court,  the 
Government  believes  that  further  description  of  the  scope  of  NSA's  upstream  collection  is 
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Additionally,  as  described  in  the  NSA's  targeting  procedures,  "in  those  cases  where  NSA 
seeks  to  acquhe  communications  about  the  target  that  are  not  to  or  from  the  target,  NSA  will 
employ  either  an  Internet  Protocol  filter  to  ensure  that  the  person  from  whom  it  seeks  to  obtain 
foreign  intelligence  infonnation  is  located  overseas,  or| 

Exihbit  A  at  2.  It  is  through  these  measures  that  NSA  prevents  the  intentional  acquisition  of 
Internet  commimications  that  contain  a  reference  to  a  targeted  selector  where  tire  sender  and  all 
intended  recipients  are  known  at  the  time  of  acquisition  to  be  located  in  the  United  States.  See. 


,e,g„  In  re  DNI/AG  Cerlification| 


lo.  702(i)-08-01,  Mem.  Op.  at  19  (USFISC  Sept.  4^ 


2008).  NSA,  NSD,  and  ODNI  are  continuing  to  examine  what  affect,  if  any,  the  type  of  .Internet 
communications  collection  discussed  in  tliis  letter  has  on  the  efficacy  of  these  measures. 
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NSA,  NSD,  and  ODNI  are  continuing  to  review  and  assess  tliis  matter  and  will  provide 
additional  information  to  the  Court  as  appropriate.  We  appreciate  the  Court's  con.si deration  of 
tb.is  matter  ajid  welcome  additional  opportunities  to  present  fitrthcr  infonnation  to  the  Court. 
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NOTICE  OF  FILING  OF  GOVERNMENT’S  SUPPLEMENT  TO  ITS  SUBMISSIONS 

OF  TUNE  Tt  AND  TUNE  28™.  2011 


THE  UNITED  STATES  OF  AMERICA,  through  the  tmdersigned  Department  of 
Justice  attorney,  respectfully  submits  the  attached  supplement  in  further  support  of  the 


Classified  by; 
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Declassify  on: 
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arguments  fjet  forth  in  suhrnissions  of  June  and  June  28^'',  2D11,  concerning  the  above- 
referenced  matters.  This  supplement  explains  the  methodology  beliind  and  sets  forth 
the  results  of  a  manual  review  by  tlie  National  Security  Agency  (NSA)  of  a  statistically 
representative  sample  of  the  nature  and  scope  of  the  Internet  communications  acquired 
tlnrough  NSA's  FISA  Amendments  Act  Section  702  upstream  collection  duriirg  a  six- 
month  period.  The  Government  respectfully  submits  that  the  data  provided  herein 
supplements  and  supports  the  Government's  Responses  to  the  Court's  Briefing  Order  of 
May  9“V  2011,  and  supplemental  questions  of  June  17, 2011,  and  wiU  further  assist  the 
Court  in  concluding  that  the  certifications  and  procedures  submitted  in  the  above- 
referenced  matters  satisfy  the  requirements  of  the  Act  and  are  consistent  with  the 
Fourth  Amendment  to  the  Constitution  of  the  United  States.  -fS/ZOONEJ- 

Given  the  complex  nature  of  the  information  provided  in  tliis  supplement,  the 
United  States  is  prepared  to  provide  any  additional  information  the  Court  believes 
would  aid  it  in  reviewing  these  matters.  The  Government  may  also  seek  to  supplement 
and/or  clarify  the  mformation  provided  herein  as  appropriate  during  any  hearing  that 


the  Court  may  hold  in  the  above-captioned  matters. 


National  Security  Division 
United  States  Department  of  Justice 
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.  (U//FOUO)  NSA  Characterization  of  Upstream  Data:  Process  and  Results 
(U)  Introduction 


fFS)yst//NF)-  This  report  explains  the  methodology  behind  and  provides  the  resultsof  a  manual 
review  of  a  statistically  representative  sample  of  Internet  communications  acquired  through  NSA's  FiSA 
Amendments  Act  (hereinafter  "FAA")  section  702  upstream. collection  during  a  six-month  period/  The 
purpose  of  this  review  was  to  assemble  data  to  assist  the  Court  in  understanding  the  nature  and  scope 
of  the  communications  acquired  through  NSA's  upstream  collection.  The  data  assembled  consisted  of: 

e  The  volume  of  transactions  containing  single,  discrete  communications  to,  from,  or  about  a 
selector  used  by  a  person  targeted  in  accordance  with  NSA's  section  702  targeting 
procedures  (hereinafter  "tasked  selector")  versus  transactions  containing  multiple 
communications  (hereinafter  "Multi-communication  Transactions"  or  "MCT")  not  all  of 
which  may  be  to,  from,  or  about  a  tasked  selector/ 


The  types  of  discrete  communications  contained  within  MCTs 

;  and 


^trSjysi/TW]-  Additionally,  as  described  on  pages  8-9  of  the  Government's  June  1,  2011  Response  to  the  Court's 
Briefing  Order  of  May  9,  2011,  NSA  conducted  two  tests  of  FAA  702  upstream  collection  in  May  2011  using 
information  from  NSA's  tecimical  databases  in  an  attempt  to  determine  the  likelihood  of  collecting  an  Internet 
transaction  between  a  user  in  the  United  States  NSA  also  attempted  to  further  determine 

the  extent  to  which  those  tests  might  be  statistically  representative  of  NSA’s  702  upstream  collection  and  repeated 
these  tests  in  July  2011  using  alternative  data  sets.  Because  of  the  technical  limitations  for  automatically 
identifying  transactions  containing  multiple  communications,  NSA  assesses  that  the  results  of  these  tests  are  not 
comparable  to  each. other  or  with  the  results  of  the  separate  manual  analysis  discussed  herein.  Furthermore,  for 
the  same  reason  of  technical  limitation,  the  results  do  not  express  as  high  a  degree  of  granularity  and  accuracy  as 
the  manual  analysis  discussed  herein,  which  took  more  than  one  month  of  careful  review  by  experienced  analysts- 
to  complete.  None  of  the  results  discussed  herein  and  In  the  Government's  June  1  Response,  however,  are 
inconsistent. 


^-fFS//SWWET  As  described  on  pages  27-28  of  the  Government's  June.l,  2011  Response  to  the  Court's  Briefing 
Order  of  May  9,  2011,  NSA's  inability  to  separate  out  Individual  pieces  of  information  from  Internet 
communications  acquired  by  NSA's  upstream  collection  systems  does  not  extend  to  all  forms  of  transactions.  NSA 
has  developed  the  capability  to  | 


t  identify  transactions  whlcf| 

I  and,  (n  certain  other  limited  instances,  transactions  where  an  "active  user"  (as  described 
more  fully  below)  is  a  tasked  selector.  Based  on  a  test  of  this  capability  from  July  16th-29th  2011,  NSA  estimates 
that  approximately  onlyi 


|of  NSA's  current  upstream  collection  under  FAA  section  702  could  be  identified 
through^^^^Mi  processes  as  communications  to,  from  or  about  NSA's  tasked  selector.  As  reflected  by  the 
results  of  this  manual  review,  this  figure  is  significantly  under-representative  of  the  total  proportion  of  NSA's 
upstream  collection  assessed  to  be  communications  to,  from  or  about  a  tasked  selector. 
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s  .The  volume  of  MCTs  that  NSA  assesses  contajn  a  wholly  domestic  communication  not  to, 
from,  or  about  a  tasked  selector,^ 

II.  (U)  How  the  Statistically  Representative  Sample  Was  Assembled 

4TS//sVt^Nf)-  NSA  assembled  the  sample  of  commurrlcations  acquired  through  Its  upstream 
collection  by  first  identifying  all  Internet  communications  acquired  under  section  702  -  i.e.,  both  from 
•NSA  upstream  collection  and  collection  from  Internet  service  providers  either  by  or  with  the  assistance 
of  the  Federal  Bureau  of  Investigation  (hereinafter  --  during  a  six-month  period  from 

January  Istthrough  June  30th,  2011,  and  present  within^^^^^^iof  July  14, 2011.  As  of  that  date, 
140,974,921  Internet  communications  were  present  within^^^BW  Of  these,  127,718,854  (or 
approximately  91%)  were  acquired  from  PRISM  collection,  and  13,256,067  (or  approximately  9%)  were 
acquired  through  NSA's  upstream  collection/ 

-{T5//5!j//Nf}- The  approximately  13.25  million  Internet  communications  acquired  through  NSA's 
upstream  collection  (hereinafter  "transactions")  were  then  "shuffled"  by  NSA  statisticians  to  ensure  a 
random  sannple  (i.e.,  any  sample  drawn  would  be  statistically  representative  of  the  total  13.25  million  . 
transactions).  NSA  statisticians  estimated  that  a  manual  review  of  a  sample  of  approximately  50,000  of 
these  randomized  transactions  would  enable  characterization  of  all  13.25  million  transactions  with  a 
statistically  high  level  of  confidence  and  precision.^ 

III.  (U)  How  the  Manual  Review  Was  Conducted  and  the  Results  of  the  Review 

-(TS7y5f//WFHJnder  the  leadership  of  NSA's  Deputy  Director,  an  experienced  interdisciplinary 
•  team  consisting  of  experienced  intelligence  analysts,  attorneys  from  NSA's  Office  of  General  Counsel, 
representatives  from  NSA's  Office  of  the  Director  of  Compliance,  NSA  statisticians,  representatives  from 
NSA’s  Network  Analysis  Center,  and  representatives  from  NSA's  Office  of  Oversight  and  Compliance  was 
assembled  to  conduct  the  review  described  herein  and  compile  this  report.  A  team  of  experienced  NSA 


^-(TS//&t//NFf  This  aspect  ofthe  review  required  analysts  to  perform  intensive  analysis  on  discrete 
communications  which  did  not  contain  the  target's  selector  within  MCTs,  to  determine  if  the  sender  and  all 
intended  recipients  of  those  discrete  communications  were  located  in  the  United  States.  Such  in-depth  analysis  is 
not  typically  conducted  by  analysts  in  their  daily  foreign  Intelligence  analysis.  Instead,  an  analyst  would  tend  to 
focus  his  or  her' attention  on  those  discrete  communications  within  the  MCT  that  are  to,  from,  or  about  their 
assigned  target,  and  would  only  perform  a  deeper  inspection  of  those  communications  to  confirm  they  were  not 
wholly  domestic  if  they  were  in-fact  pertinent  to  the  analyst's  evaluation  of  foreign  intelligence  information  and 
therefore  worth  further  analysis  for  potential  use. 


This  figure  does  not  include  Internet  communications  that  were  acquired  during  this  six-month 
period  but  were  purged  prior  to  July  14, 2011.  ^ 


‘^ffS/ZSiTf/NF)  See  Figure  A  of  Appendix  A,  attached  hereto. 

Details  for  the  basis  for  NSA's  statistical  assertions  are  set  forth  in  Appendix  B,  attached  hereto. 
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intelligence  analysts  was  assigned  to  conduct  a  manual  review  of  the  transactions.  Uitimately,  that 
team  of  NSA  intelligence  analysts  collectively  reviewed  a  total  of  50,440  individual  transactions. 

In  order  to  ensure  consistency  among  the  analysts  in  their  review,  before 
beginning  the  manual  review,  the  team  members  were  trained  to  recognize  MCTs  and  how  to 
characterize  the  discrete  communications  contained  within  them.  The  team  members  were  given 
training  materials  created  specifically  for  this  effort,  which  included  screenshots  depicting  typical 
examples  of  the  types  of  transactions  acquired  through  NSA's  upstream  collection.  MSA's  Office  of 
General  Counsel,  Office  of  Oversight  and  Compliance,  and  Office  of  the  Director  for  Compliance 
reviewed  all  training  materials  and  provided  guidance  throughout  the  manual  review.  ' 

{TSyysWf^)  For  quality  assurance,  some  transactions  (approximately  10  out  of  every  5,000) 
underwent  independent  reviews  by  more  than  one  analyst,  in  addition,  the  team  lead  performed  spot 
reviews  of  transactions  that  had  already  undergone  review  (approximately  1  out  of  every  100).  The 
team  lead  also  personally  reviewed  any  transaction  that  team  members  were  unable  to  immediately 
characterize  as  clearly  being  a  discrete  communication  or  an  MCT;  as  well  as  any  MCT  identified  as 
potentially  concerning  a  person  located  in  the  United  States,  Both  the  quality  assurance  overlap  and  the 
reviews  performed  by  the  team  lead  revealed  no  discrepancies  among  how  analysts  characterized  any 
of  the  transactions  subjected  to  these  overlapping  reviews. 

fFSjVSfjYNf)  in  conducting  the  manual  review,  NSA  analysts  took  the  following  steps  and  made 
the  following  findings: 

1,  Determined  if  the  transaction  was  a  single,  discrete  communication  or  an  IVICT.®  If  the 
transaction  was  determined  to  be  a  single,  discrete  communication,  no  further  analysis  was 
done.  Transactions  determined  to  be  MCTs  were  further  analyzed,  as  described  below. 


®  Of  the  50,440  transactions  reviewed,  45,359  (approximately  90%)  were  determined  to 
be  single,  discrete  communications.  The  remaining  5,081  transactions  (approximately 
10%)  v>fere  determined  to  be  MCTs.^ 


-(T5-/7^I//NF)  For  any  objects  that  the  initial  reviewer  was  uncertain  about  howto  characterize  (e.g.,  ifthe 
transaction  contained  data  requiring  further  processing  to  render  it  intelligible  to  the  analyst),  the  team  lead 
performed  a  second  review.  As  a  result,  each  of  50,440  transactions  reviewed  were  able  to  be  characterized  as 
being  either  a  single,  discrete  communication  or  an  MCT. 


5ee  Figure  B  of  Appendix  A. 
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T©P-SEeRET//e©IVHWf//N©F0^ 


3.  Determined  whether  the  5,081  WICTs  contained  any  discrete  communications  as  to  which 
the  sender  and  all  intended  recipients  were  located  in  the  United  States.  As  discussed  in 
more  detail  below,  in  many  cases’NSA  analysts  were  able  to  make  these  determinations 
based  on  the  location  of  the  "active  user"  of  the  In  other,  cases,  NSA  had  to  rely  on 

content  analysis  because  the  MCT  did  not  contain  technical  information  sufficient  to 
identify  the  active  user  or  to  determine  the  active  user's  iocation.  There  were,  however, 
instances  where  the  MCT  did  not  contain  sufficient  technical  information  or  content  for  NSA 
to  assess  whether  the  MCT  contained  any  wholly  domestic  communications. 

0  Of  the  5,081  MCTs,  713  (approximately  14%)  had  a  tasked' selector  as  the  active  u.ser 
IIPgllllllBlllllIBgllllll^^  No  further 

analysis  of  these  MCTs  was  done  to  determine  whether  they  contained  wholly 
domestic  communications.  That  Is  because  the  user  of  the  tasked  selector,  who  by 
operation  of  the  NSA  targeting  procedures  Is  a  person  reasonably  believed  to  be 
located  outside  the  United  States,  would  be  either  the  sender  or  an  intended  recipient 
of  each  of  the  discrete  communications  contained  within  the  MCT.^'*  Accordingly,  all  of 
the  discrete  communications  within  those  MCTs  Vv/ould  have  at  least  one  communicant 
reasonably  believed  to  be  located  outside  the  United  States  (i.e.,  the  target)  and  thus 
would  not  be  wholly  domestic. 

0  Of  the  5,081  MCTs,  2,668  (approximately  52%)  had  an  active  userthat  was  not  a  tasked 
•  selector  but  wasmonetheless  an  electronic  communications  account/address/identifier 


See  Figure  C  of  Appendix  A. 


'"-fFS//5WNF)-| 


When  NSA  acquires  an  internet  transaction  between  an  Individual  using  an  electronic 
communications  account/address/identifier  and  his/fier  service  provider,  that  individual  is  the  "active  user"  for 
that  transaction.  Such  transactions  can  have,  at  most,  one  "active  user." 


^''4TS//5l)iyNf)-  in  this  context,  a  communication  to  or  from  the  target  includes  communications  to  or  from  the 
tasked  selector  itself  (e.g.,  an  e-mail  sent  to  a  tasked  e-mall  account),  as  well  as  communications  where  the  tasked 
selector  appears  in  other  communications  attributable  to  the  target 


See  In  r.e.DNI/AG  Certiflcatioi 

Docket  No.  702(t)-08-01,  Mem.  Op.  at  17  n'.14  (USFISC  Sept.  4,  2008). 
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reasonably  believed  to  be  used  by  a  person  located  outside  the  United  States.^^  No 
further  analysis  of  these  MCTs  was  done  to  determine  whether  they  contained  wholly 
domestic  communications.  That  Is  because  the  foreign-based  active  user  would  be 
either  a  sender  or  intended  recipient  of  each  of  the  discrete  communications  within 
the  transaction.  Accordingly,  ail  of  the  discrete  communications  within  those  MCTs 
would  have  at  least  one  communicant  reasonably  believed  to  be  located  outside  the 
United  States  (i,e.,  the  foreign-based  active  user)  and  thus  would  not  be  wholly 
domestic. 

®  Of  the  5,081  MCTs,  8  (approximately  0.16%)  contained  an  electronic  communication 
account/address/identifier  of  a  non-targeted  active  user  who  appeared  to  be  located 
in  the  United  States,  but  none  of  the  discrete  communications  within  the  MCT  were 
determined  to  be  wholly  domestic  because  at  least  one  of  the  communicants  to  each 
discrete  communication  was  reasonably  believed  to  be  located  outside  the  United 
States.  Specifically,  the  8  MCTs  were  determined  to  concern  six  non-targeted  active 
users  (f.e.,  two  of  the  MCTs  were  duplicates): 

o 


o 


o 


o  Of  the  5,081  MCTs,  10  [approximately  0.2%)  contained  an  electronic  communication 
account/address/identifier  of  a  non-targeted  active  user  who  was  located  in  the  United 
States,  and  the  MCTs  contained  at  least  one  discrete  communication  that  was  wholly 


Four  MCTs  (including  both  duplicates)! 

contained  at  least'one  e-mail  message  from  a  tasked  selector  as  well  as 
other  e-mail  messages  from  accounts/addresses/identifiers  reasonably  believed 
to  be  used  by  a  person  located  outside  the  UnitedStates^ 


Three  MCTs^^^^^^^^^gwith  the  users  of  accounts/addresses/identifiers 
who  were  reasonably  believed  to  be  located  outside  the  United  States/^ 


that  the  active  user  was  reasonably  believed  to  be  located  outside  the  United 
States. 


‘®fFS//Si//NF)  To  deterinine  the  location  of  the  non-targeted  active  user,  NSA  performed  the  same  sort  of 
analysis  it  would  perform  before  tasking  an  electronic  communications  account/address/ldentifier  in 
accordance  with  its  FAASection  702  targeting  procedures. 

To  determine  the  location  of  the  senders  of  each  of  these  discrete  e-mail  messages,  NSA  performed 
the  same  sort  of  IW 


l^analysis  it  would  perform  before  tasking  an  electronic  communications 
accoiint/address/identifierin  accordance  with  its  FAASection  702  targeting  procedures. 

•  To  determine  the  location  NSA  performed  the  same  sort  of 

I  analysisit  would  perform  before  tasking  an  electronic  communications  account/address/ldentifier  in-  — 
accordance  with  its  FAA  Section  702  targeting  procedures. 


Wikimedia  Found,  v.  NSA  000000121 


To  determine  the  location  of  the  other  communicants,  NSA  performed  the  same  sort  of 
-  analysis  it  would  perform  before-tasking-an  electronic  communications  account/address/identifier  in  accordance 
with  its  FAA  Section  702  targeting  procedures. 
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located  outside  the  United  States  and  thus  were'not  assessed  to  be  wholly 
domestic.^° 


Ofth^,081  MCTs,  1^682  (approximately  33%)  required  further,  In-deotl-^^^^M 
analysis  because  they  lacked  information  sufficient  for  NSA  to  readily  identify 
the  active  user  or  determine  the  active  user's  location.  In  most  of  these  cases,  the 
transactions  did  not  contain  enough  information  for  NSA  to  readily  determine  which 
electronic  communication  account/address/identifier  appearing  in  the  transaction  was 
that  of  the  active  user.  In  other  cases,  NSA  was  able  to  determine  which  electronic 
communication  account/address/identifier  appearing  in  the  transaction  was  that  of 
the  "active  user,"  but  NSA  was  unable  to  determine  the  active  user's  location.  NSA's 


o  For  86  of  these  1,682  MCTs,  NSA  analysis  of  a  combination  of  technical  data  and 
content  revealed  that  they  appeared  to  contain  communications  of  persons 
located  outsfde  the  United  States  (e,g,,  through  further  content  analysis,  NSA 
analysts  were  able  to  identify  the  active  users  of  some  MCTs  and  information 
indicative  of  those  users’  locations). 


©  Of  the  5,081  MCTs,  NSA  cannot  determine  whether  224  MCTs  contained  wholly 

domestic  communications,  because  these  MCTs  lack  information  sufficient  for  NSA  to 
identify  the  active  user  or  determine  the  active  user's  location.  Nevertheless,  NSA  has 
no  basis  to  believe  any  of  these  MCTs  contain  wholly  domestic  communications, 


o 


For  182  of  these  224  MCTs,  NSA  technical  analysis  indicates  thatthey  were 


o 


For  1  of  these  224  MCTs,  NSA  initially  determined  that  it  contained  an  electronic 
communication  account/address/identifier  of  a  non-targeted  active  user  who 
appeared  to  be  located  in  the  United  States,  but  whose 
determined 


To  determine  the  location  of  the  other  communicants,  NSA  performed  the  same  sort  of  | 
analysts  it  would  perform  before  tasking  an  electronic  communications  account/address/identifler-in  accorclanGe 


with  its  FAA  Section  702  targeting  procedures. 
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o  23  of  these^^i^^s  were  not  further  analyzed  because,  although  they  were 

present  in^^d^^as  of  the  date  the  sample  was  assembled,  they  were 
subsequently  purged  and/or  placed  on  NSA’s  Master  Purge  List. 

o  18  of  these  224  MCTs  could  not  be  further  characterized  by  NSA  analysts. 

IV.  ■  (U)  Conclusions  Drawn  from  the  Random  Sample 


Based  on  a  random  sample  of  the  approximately  13.25  million  total  Internet 
communications  acquired  by  NSA  through  "upstream"  techniques  pursuant  to  FAA  section  702  for  the 
six-month  period  discussed,  NSA  assesses  that  the  volume  of  transactions  containing  multiple 
communications  not  all  of  which  may  be  to,  from,  or  about  a  tasked  selector  is  approximately  between 
1.29  and  1.39  million  (9.70%-10.45%).^^  With  respect  to  the  types  of  discrete  communications 
contained  vvithin  rriulti-connmunicatlon  transactions  manually  reviewed  by  NSA  analysts, 


As  described  in  Appendix  B,  which  details  NSA's  Statistical  Methodology  for  this 
review,  the  data  compiled  during  the  above-discussed  manual  review  of  a  random  sample  of  Internet 
communications  acquired  during  a  six-month  period  can  be  used  to  characterize  with  a  statistically  high 
degree  of  confidence  (i.e.,  a  simultaneous  confidence  level  of  95%  for  these  intervals  collectively)  the 
nature  and  scope  of  the  entirety  of  the  approximately  13,25  million  Internet  communications  from 


^*-(TS//Si//NF)  As  calculated  In  the  attached  Appendix  detailing  NSA's  Statistical  Methodology  for  this  review,  these 
figures  are  based  on  the  45,359  of  the  50,440  transactions  (89.93%)  manually  reviewed  by  NSA  analysts  as 
containing  single,  discrete  communications  and  the  5,031  transactions  (10.07%)  manually  reviewed  by  NSA  . 
analysts  as  containing  multiple  communications.  See  also  Step  1,  supra  page  3. 
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which  the  random  sample  was  drawn.  Specifically,  NSA  assesses  that  ofthese  approximately  13.25 
million  Internet  communications  acquired  through  NSA  upstream  collection; 

m  between  approximately  11.87  and  11.97  million  (89.55%-90.30%)  are  transactions  that 
contain  only  single,  discrete  communications  to,  from,  or  about  a  tasked  selector; 

a  between  168,853  and  206,922  (l,27%'l.S6%f  ^  are  transactions  that  contain  multiple 
communications,  ail  of  which  are  either  to  or  from  a  tasked  selector; 

a  between  1,042,838  and  1,113,947  (7.87%-8.53%)^''  are  transactions  that  contain  multiple 
communications,  at  least  one  of  which  is  to,  from,  or  about  NSA's  tasked  selector,  but  all  of 
which  are  believed  to  either  be  to  or  from  non-targeted  persons  reasonably  believed  to  be  • 
located  outside  the  United  States; 

H  between  48,609  and  70,168  (0.37%-0.53%)”  are  transactions  that  contain  multiple 

communications,  at  least  one  of  which  is  to,  from,  or  about  NSA’s  tasked  selector,  and  at 
least  one  of  which  is  a  communication  between  non-targeted  persons  (i.e.,  not  to,  from  or 
about  a  tasked  selector)  that  lacks  sufficient  information  for  NSA  to  identify  the  location  of 
the  sender  and  ati  intended  recipients  of  that  communication;  and 

a  between  996  and  4,965  (0.0075%-0,0375%)  contain  a  wholly  domestic  communication  not 
to,  from,  or  about  a  tasked  selector. 


~(TS//&l//Nf)-ln  sum,  while  there  was  insufficient  information  present  for  224  multi¬ 
communication  transactions  for  NSA  analysts  to  characterize  the  likelihood  that  they  may  contain  wholly 
domestic  communications  (the  majority  of  which  were  attributable  tcj 

,  for  the  reasons  explained  in  detail 


As  calculated  in  the  attached  Appendix,  these  figures  are  based  on  713  of  the  S,081  MCTs  (14.03%) 
and  50,440  total  transactions  (1.41%)  reviewed  by  NSA  analysts  as  containing  a  tasked  selector  as  the  active  user 

See  also  Step  3,  supra  page  4. 

’’°'(T5//SI//Nr)As  calculated  In  the  attached  Appendix,  these  figures  are- based  on  4,134  of  the  5,081  MCTs 
(81.36%)  and  50,440  total  transactions  (8,19%)  reviewed  by  NSA  analysts  as  containing  discrete  communications 
believed  to  be  to  or  from  non-targeted  persons  located  outside  the  United  States.  More  specifically,  this  total 
includes  the  following  MCTs  manually  reviewed  by  NSA  analysts:  2,668  that  had  an  active  user  reasonably 
believed  to  be  a  person  located  outside  the  United  States;  8  that  included  at  least  one  communicant  reasonably  ’ 
believed  to  be  located  outside  the  United  States  for  each  communication  therein;  1,220  that  are  characteristic  o^ 

1 152  that  are  indicative  of 

and  86  that  all  communications  contained  therein  were  to  or  from  persons 
located  outside  the  United  States,  See  Step  3,  supra  pages  4-6, 


As  calculated  in  the  attached  Appendix,  these  figures  are  based  on  224  of  the  5,081  MCTs  (4.41%) 
and  50,440  total  transactions  (0.44%%)  reviewed  by  NSA  analysts  that  lacked  suffident  informatlon-to  identify  the  - 
active  user  or  the  active  user's  location.  See  Step  3,  supro  page  6. 
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above,  NSA  has  no  basis  to  believe  any  of  the  remaining  Internet  communications  reviewed  in  the 
50,440  sample  .are  wholly  domestic  beyond  those  10  discussed  above.^®  Moreover,  each  of  those  10 
Internet  communications  has  been  placed  on  NSA's  Master  Purge  List. 


The  remainder  of  this  page  intentionally  left  blank. 


^i.{TS4^l//NP)-^ee  Figure  D  of  Appendix  A. 
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(U)  VERlFIGATiON 

(U)  I  declare  uitdfer  penalty  of  perjury  that  the  facts  set  forth  in  the  foregoing  "NSA 
Cliafaetefizatipn  of  Upstream  Data:  Process  and  Results"  are  true.and  correct  based  upon'my  best- 
Information,,  knowledge  and  belief.  Ex'ecutedpursuant  to  Title  28,  United  .States  Coc|e,  §  1746,  on  this 
16th  day  of  August,  20ri. 


National  Security  Agency 


Signals  Intelligence  Directorate  Compliance  Archltecfc 


ix' 
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Appendix  A 


Fig.  A  Total  FAA  702 


Fig.  B  Total  Upstream  Sample 
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Fig.  C  MCT  Type 


Fig.  D  Summary 
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Anoentlix  B;  Statistical  Mctliodologv  -FAA  Section  702  Upstream  Manual  Review 


;  statistical  analysis  NSA  determined  the  proportions  of  transactions 
satisfying  certain  criteria  (e.g,,  proportion  of  FAA  Section  702  upstream  Internet  transactions 
that  are  Multi-cojmminication  Transactions  (MCT)  versu?  transactions  containing  single, 
discrete  communications).  As  fiirtlier  described  below,  transactions  were  categorized  in  various 
ways.  The  categorization  process  can  be  complex;  to  minimize  categorization  en'or,  NSA  used 
a  statistical  approach  involving  actual  examination  of  an  appropriate  sample  of  transactions  by 
experienced  intelligence  analysts.  (Tlie  use  of  only  a  sample  is  a  concession  to  the  large 
volume  of  transactions  and  the  labor-intensive  nature  of  the  categorization  process.)  That  is, 
NSA  traded  "categorization  error"  for  "statistical  error";  the  latter  refers  to  the  fact  that  by 
considering  only  a  randomly  sampled  portion  of  the  universe  of  transactions,  NSA  estimated 
the  true  proportions  (as  they  exist  in  the  universe)  '-  with  error  bounds  and  levels  of  confidence 
that  can  be  stated  justifiably. 


—(TS/ZSK^NF^RE  SAMPLE.  As  discussed  more  fully  in  the  ‘‘NSA  Characterization  of 
Upstream  Data:  Process  and  Results,”  NSA  identified  13,256,067  transactions  acquired  tlnrough 
NSA's  FAA  702  upstream  collection  during  a  six-month  period  from  January  tlirougli  June 
30''‘,  2011.  Of  those  approximately  13.25  million  transactions,  a  team  of  experienced 
intelligence  analysts  careflilly  examined  50,440  over  a  nearly  one-month  time  period.  The 
transactions  were  presented  to  the  analysts  in  a  randomized  order,  ensuring  that  a  simple 
random  sample  would  serve  as  the  basis  for  conclusions  -  supported  by  statistical  theory  - 
about  the  true  proportions  of  the  13.25  million-trausactioii  universe. 


(T&A«y/NF)  ESTIMATES  AND  CONFIDENCE  INTERVALS,  The  proportions  formed 
from  the  sampled  transactions  serve  as  unbiased  estimates  of  the  corresponding  proportions  of 
the  13,256,067~transaction  universe.  Fm-ther,  for  (six)  selected  proportions,  NSA  .states  a 
confidence  inteiwal  for  each.  Collectively,  these  inteivals  have  a  vsimultaneous  confidence  level 
of  95%.  This  means  tliat  die  intervals  were  produced  by  a  procedure  calibrated  to  produce,  for 
at  least  95%  of  the  sample  sets  NSA  could  have  drawn,  intervals  which  aU  cover  the 
corresponding  true  (i.e.,  universal)  proportions.  Individually,  each  inteival  has  a  Mgher  level  of 
confidence  associated  with  it;  component  confidence  levels  are  quoted  below. 

-fFSTTSFZ^^F)-  For  each  of  the  six  categories,  NSA  also  states  a  confidence  interval  for.  the  actual 
number  of  that  category’s  transactions  within  the  13,256,067-traasaction  (January- June,  2011 
upstream)  universe.  Such  ail  inteival  is  smiply  an  equivalent  representation  of  the 
corresponding  proportion-interval  (it  is  obtained  by  mnidplying  the  endpoints  of  the  propoilion- 
intcrval  by  13,256,067),  and  so  the  inclusion  of  such  intervals  does  not  affect  the  (95%)  level  of 
simultaneous  confidence. 

•fFStfSFTNF)  Specifically;  By  sampling  a  subset  of  the  universe  (or  population)  ofupsheam 
transactions,  NSA  estimated  the  following  six  proportions.  (Hereinafter,  N  denotes  13,256,067 
-  the  size  of  that  universe;  M  denotes  the  (unlmown)  actual  number  of  MCTs  in  that  universe). 


o  M/M  the  proportion  of  the  population  comprising  MCTs;  . 

Derived  From;  NS^76S^^^52 
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0  \-{M /N):  the  proportion  of  the  population  comprising  discrete  transactions; 


a  the  proportion  of  the  population  comprising  MCTs  in  which  all  coiruuunications  are 
either  to  or  fi'om  NSA’s  tasked  selector  (hereinafter  labeled  “Target”  MCTs); 


0  the  proportion  of  the  population  comprising  MCTs  in  which  all  communications  are 
believed  to  either  be. to  or  from  non-targeted  persons  located  outside  the  United  States 
(hereinafter  labeled  “Foreign”  MCTs); 

a  the  proportion  of  the  population  comprising  MCTs  in  which  the  nature  of  one  or  more 
communications  between  non-targeted  persons  lacked  sufficient  information  for  NSA 
•  analysts  to  identify  the  location  of  the  sender  and  all  intended  recipients  (hereinafter 
labeled  “Unlarownable”  MCTs);  ■ 


®  the  proportion  of  the  population  comprising  MCTs  that  NSA  analysts  assessed  contain  a 
wholly  domestic  not  to,  from,  or  aboirt  a  tasked  selector  (hereiiiafter  labeled  “Confirmed 
Wholly  Domestic”). 


i  the  total  of  the  last  four.)  Tn  the  following, 
lower-case  letters  denote  transaction  counts  as  realized  in  lire  sample,  in  categories 
corresponding  to  their  upper-case  counterparts.  That  is,  n  is  the  number  of  transactions 
sampled  (this  turned  out  to  be  50,440),  and  m  is  the  number  of  MCTs  in  the  sample. 


•(TS//S1//NF)  OUTLINE  OF  PROCEDURE.  NSA  designed  a  procedure  that  accepts  a  size-K 
simple  random  sample'  of  the  population,  and  produced  from  it  estimates  and  confidence 
mteiwals  for  the  six  “tme”^  proportions  NSA  sought.  The  estimates  NSA  produced  are  simply 
the  corresponding  proportions  as  found  in  the  sample  -  e.g.,  the  sample  proportion  m/n  was 
NSA’s  estimate  of  the  population  proportion  M/W;  such  a  sample  proportion  is  unbiased^  for  its 
population  counterpart,  meaning  that  were  a  sample  proportion  to  be  computed  for  each  of  the 
possible  size-«  samples  that  could  be  drawn,  the  average  of  these  sample  proportions  would 
equal  the  “true”  (iiopulation)  proportion. 


^  (TS//SFi91F)  A  simple  laiidom  sainple  is  one  that  is  drawn  in  a  way  that  ensures  that  all  possible  size-n  subsets 
of  the  (size-Ai)  population  have  an  equal  chance  of  being  selected;  tliis  sampling  tccluiiquc  enables  statistically 
justifiable  claims  by  avoiding  potential  (known  or  unknown)  sources  of  bia.s  in  the  population  (e.g.,  a  periodic 
trend  in  the  population  over  time). 


“True”  refers  to  proportions  that  relate  to  tlie  entire  population,  which  cannot  bo  determined  for 
certain,  as  n  is  smaller  than  N. 


^  ffS?ySiiWP)  Unbiasedness  means  that  the  estimate  is  aiming  for  the  right  “target”;  however,  it  indicates  nothing 
about  the  precision  of  the  estimate.  An  estimation  procedure  can  beimbiascd  wholhev  it  is  based  on  a  small  or 
largo  sample  size  n. 
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-fFS/ZSiiWl^  To  express  precision  appropriately,  NSA  designed  its  procedure  to  produce 
confidence  intervals  -  one  for  each  of  tire  (six)  population  proportions  of  interest  -  having  a 
simultaneous  confidence  level  of  95%,  This  means  tliat; 

0  Based  oai  a  sample,  the  procedure  will  produce  a  collection  of  intervals,  each  asserted  to 
contain  the  hue  (population)  proportion  it  targets. 

o  Because  die  procedure  operates  on  a  random  sample,  the  interval  endpoints  are  random 
variables’,  the  particular  collection  of  intervals  a  particular  sample  yields  may  fail  to 
cover  one  or  more  of  the  population  proportions  it  targets.  But  tire  procediure  is 
designed  so  that  this  failure  probability  ~  wAa/ever  the  true  proportions  are  —  is  no  more 
than  5%;  that  is,  for  at  least  95%  of  the  (size-j?)  simple  random  samples  it  might 
process,  the  procedure  will  produce  intervals  which  all  cover  their  targeted  population 
proportions. 


o  hi  order  to  aclrieve  tins  level  of  confidence  about  a  collection  of  intervals 

simultaneously,  the  procedure  is  designed  so  that  the  respective  failure  probabilities 
associated  with  tire  component  intervals  total  no  more  than  5%.  hi  particular,  this  5% 
was  allocated  as  follows: 

o  2.5%  to  die  proportion  of  “Coufiiiiied  Wliolly  Domestic”; 
o  0.67%  to  each  of  the  "Target,”  “Foreign,”  “Unlcnown”  proportions; 
o  0.5%  to  file  proportion  of  MCT  (i.e.,  M /N).  As  the  proportions  of  discrete  and 
MCT  transactions  are  complementary  (i.e,,  they  total  1),  the  confidence  iiiteml 
for  the  proportion  of  discrete  transactions  is  obtamed  by  subtracting  each  of  the 
endpoints  for  the  MCT-intei'val  ftom  1  —  and  it  is  the  case  that  one  of  these 
inten'als  will  cover  its  population  target  if  and  only  if  the  other  does.  Therefore, 
tliere  is  no  need  to  separately  allocate  “faihu'e  probability”  to  the  proportion-of- 
discrete. 

fFS//Si9NF-}  The  probability  of  drawing  a  sample  resulting  in  one  or  more  “failing”  intervals  is 
no  more  than  the  sum  of  the  failure  probabilities  of  the  respective  component  intervals,  hence 
the  claun  of  95%  confidence  for  the  procedure  outlined  here.  The  “no  more”  qualification 
makes  this  tecimique  conseivative:  relationsliips  (complicated  and  left  unanalyzed)  between  the 
random  variables  involved  may  make  the  practical  confidence  level  higher;  95%  represents  a 
worst-case  claim.  To  achieve  simultaneous  95%  confidence,  the  5%  failure  probability  could 
have  been  allocated  in  any  way.  ■  (Broadly:  the  lower  the  confidence  level  (i.e.,  die  higher  the 
failure  probability),  the  narrower  the  intei-vals  the  procedure  v/ill  produce.  An  extreme 
example:  a  procedure  for  100%  confidence  intervals  would  produce  uselessly  wide  intervals,  as 
it  would  have  to  be  able  to  claim  that  its  inteivals  cover  truth  for  every  possible  size-«  sample  it 
could  have  received.)  This  procedure  for  simultaneous  intervals  is  conservative  in  a  further 
way:  .hist  as  the  sum  of  the  discrete  and  MCT  proportions  equals  1,  so  does  the  sum  of  the 
discrete,  “Target,”  “Foreign,”  “Unlaibwn,”  and  “Confirmed  Wlrolly  Domestic”  proportions.  It 
is  difficult  to  exploit  this  latter  constraint  properly;  NSA  utilized  the  conservative  method 
described  here  to  ensure  'that  its  assertions  about  tlie  procedure’s  performance  are  valid. 
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CONFIDENCE-INTERVAL  PROCEDURE  FOR  A  SINGLE 
PROPORTION.  As  outliaed  above,  the  procedure  for  (95%)  simullaueous  confidence 
intervals  was  achieved  by  producing  cojnponont  confidence  intenfals  based  on  (individually 
higher)  levels  of  confidence  (e.g.,  99.5%  for  M./N).  Tlie  construction  of  component  confidence 
inteivals  can  be  understood  via  the  following  example,  using  the  M/N  target.  For  the  sample 
■  of  size  n  to  be  observed,  m  represents  the  (random)  number  of  MCTs  to  be  realized  in  the 
sample.  Formally,  m  has  a  hypergeometric  distribution  (arising  from  sampling  transactions 
"without  replacement’’^^;  to  make  the  mathematical  computations  tractable,  NS  A  approximated 
tins  distribution  by  a  binomial  distribution  corresponding  to  sampling  -with  replacement  (in 
wlrich  each  sampled  transaction  would  be  replaced  after  it  is  drawn,  and  hence  would  be 
eligible  to  be  drawn  multiple  times),  Tliis  approximation  is  imiformly  conservative;  i.e.,  it  will 
result  in  wider  intervals.  The  proportion  to  be  estimated,  M/JV,  appears  as  the  (unlcnown) 
parameter  (now  denoted  p)  of  this  binomial  distribution.  Treating  m  as  a  binomial  random 
variable  based  on  n  trials,  NS  A  used  an  accepted  method  (the  Clopper-Pearson  method)  as  the 
basis  to  devise  its  coufidence-inteival  procedure  for^,  (Below,  the  notation  B(h,^)  refers  to  an 
«-trial  binomial  random  variable  having  parameter  q)  Upoii  ob.serving  m,  NSA: 

a  Determines,  for  each  of  various  proportions  x  between  0  and  0.5%,  parameters  q  and  r 
such  that 

o  jc  is  the  probability  tliat  a  B{n,q)  random  variable  takes  a  value  of  at  least  m  (but 
if  7n=0,  take  q  to  be  0); 

o  (0.5%  -  -v)  is  the  probability  that  a  B(/z,x)  random  variable  takes  a  value  no  larger 
than  m  (but  if  in=n,  take  r  to  be  1). 

}•  exceeds  q;  the  pair  [^.r]  determines  an  interval. 

0  Determines  the  narrowest  of  all  such  intervals  [q,r]  and  reports  it  as  the  (99.5%) 
confidence  interval  ■  for  M IN. 

Practically,  the  ^’s  and  r’s  can  be  computed  using  inverse  Beta  functions,  and 
computer  software  can  fiird  the  narrowest  interval  efficiently, 
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RESULTS: 


#  of  tfansactionis 
in  sample 

Sample 

proportion 

(of702 

upstream) 

Confidence  interval  for 
corresponding  universal 
proportion 

Confidence  interval  for 
the  actual  number  (of 
the  13.25  million)  . 

Discrete 

45,369 

0.8993 

0.8955-0.9030 

11.870,284-11,970,275 

MCT 

5,081 

- 

0.0970-0.1045 

1,285,792-  1,385,783 

#of 

transactions  in 
sample 

Sample  ■ 

proportion 

(ofMCT) 

Confidence ,  interval  for,  , 
corresponding  universal 
(MCT)  proportion 

Confidence  intei-val 
for  tire  actual 
number  (of  the  13.25 
million) 

TARGET 

713 

.  0,01414  ' 

0.01274-0,01561 

168,853-206,922 

FOREIGN 

4,134 

0.08196 

0,07867-0.08532 

1,042,838-1,130,947 

UNKNOWABLE 

224 

.  0.004441 

0,003667-0.005293 

48,609-70,168 

CONFIRMED 

WHOLLY 

DOIVIESTIC 

10 

0.0001983 

0.00007508  -  0,0003746 

996-4,965 

Remainder  of  this  page  intentionally  left  blank. 


5 


Wikimedia  Found.  V.  NSA  DOJ000133 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  545  of  1298 


Approved  for  public  release. 


All  withheld  information  exempt  under  b(1)  and  b(3)  except  as  otherwise  noted. 


VERlFrCATlON 

I  declare  under  penalty  of  perjury  that  the  facts  set  forth  hi  this  Appendix:  are  true  and 
coifect  based  upon  iny  best  inlbrnlatioh,  kiibvvledgd  and  belief.  Executed  pursuant  to  Title-28, 
United  States  Code,  Section  1746,  on  this  1 day  of  August,  2011. 
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JOINT  STATEMENT  OF 

LISA  O.  MONACO 
ASSISTANT  ATTORNEY  GENERAL 
FOR  NATIONAL  SECURITY 
U.S.  DEPARTMENT  OF  JUSTICE 

JOHN  C.  (CHRIS)  INGLIS 
DEPUTY  DIRECTOR 
NATIONAL  SECURITY  AGENCY 

ROBERT  S.  LITT 
GENERAL  COUNSEL 

OFFICE  OF  DIRECTOR  OF  NATIONAL  INTELLIGENCE 

BEFORE  THE 

PERMANENT  SELECT  COMMITTEE  ON  INTELLIGENCE 
UNITED  STATES  HOUSE  OF  REPRESENTATIVES 


AT  A  HEARING  CONCERNING 
“FISA  AMENDMENTS  ACT  REAUTHORIZATION” 


PRESENTED  ON 
DECEMBER  8,  2011 
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Joint  Statement  of 

Lisa  O.  Monaco 
Assistant  Attorney  General 
for  National  Security 
U.S.  Department  of  Justice 

John  C.  (Chris)  Inglis 
Deputy  Director 
National  Security  Agency 

Robert  S.  Litt 
General  Counsel 

Office  of  Director  of  National  Intelligence 
Before  the 

Permanent  Select  Committee  on  Intelligence 
United  States  House  of  Representatives 


At  a  Hearing  Concerning 
“FISA  Amendments  Act  Reauthorization” 


Presented  on 
December  8,  2011 
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(U)  Recent  FISC  Opinion 

tTS//SI//NF)  On  October  3,  201 1,  the  FISC  issued  an  opinion  addressing  the  Government’s 
submissior^njeplacemen^ertification^indersectior^02^^^  DNI/AG  Certification  2()()9-C, 

Mem. 

most  of  the  Government’ s  submissioITltupneluNSA’saiiaT^’s  targeting  procedures,  CIA’s 
and  FBI’s  minimization  procedures,  and  most  of  NSA’s  minimization  procedures.  Nevertheless, 
the  FISC  denied  in  part  the  Government’s  requests  because  of  its  concerns  about  the  rules 
governing  the  retention  of  certain  non-targeted  Internet  communications  acquired  through  NSA’s 
upstream  collection.  The  FISC’s  exhaustive  analysis  of  the  Government’s  submission,  like  its 
other  decisions,  refutes  any  argument  that  the  court  is  a  “rubber  stamp,”  and  demonstrates  the 
rigorous  nature  of  the  oversight  it  conducts. 
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(TS/ZSty/NF)  As  described  above,  upstream  collection  allows  NSA  to  acquire,  among  other 
things,  communication^boutatarget  where  the  target  is  not  itself  a  communicant.  In  doing  so 
NSA  that  are  reasonably  designed  to  screen  out  communications 

that  are  wholly  domestic  in  nature,  in  accordance  with  section  702’s  requirements.  Although 
reasonably  designed  to  accomplish  this  result^^^^H  are  not  perfect.  In  addition,  upstream 
collection  devices  acquire  Internet  “transactions”  that  include  tasked  selectors.  Such  a 
transaction  may  consist  of  a  single  communication  (a  “single-communication  transaction,”  or 
SCT)  or  multiple  communications  sent  in  a  single  transaction  (a  “multi-communication 
transaction,”  or  MCT)^ 

In  .such  instances, 

upstream  collection  acquires  the  entire  MC  T,  which  in  all  cases  will  include  a  communication  to, 
from,  or  about  a  tasked  selector  but  in  some  cases  may  also  include  communications  that  are  not 
about  a  tasked  selector  and  may  have  no  relationship,  or  no  more  than  an  incidental  relationship, 
to  the  targeted  selector.  Thus  although  upstream  collection  only  targets  Internet  communications 
that  are  not  between  individuals  located  in  the  United  States  and  are  to,  from,  or  about  a  tasked 
account,  there  is  some  inevitable  incidental  collection  of  wholly  domestic  communications  or 
communications  not  to,  from,  or  about  a  tasked  account  that  could  contain  U.S.  person 
information.  Based  on  a  sample  reviewed  by  NSA.  the  percentage  of  such  communications  is 
very  small  (about  .02%),  but  given  the  volume  of  the  upstream  collection,  the  FISC  concluded 
that  the  actual  number  of  such  communications  may  be  in  the  tens  of  thousands  annually. 


(TS//S1//NF)  The  FISC  upheld  NSA’s  continued  upstream  acquisition  of  Internet 
communications  under  section  702  even  though  it  includes  the  unintentional  acquisition  of 
wholly  domestic  communications  and  the  incidental  acquisition  of  MC'I's  that  may  contain  one 
or  more  individual  communications  that  are  not  to,  from,  or  about  the  tasked  selector.  See  id.  at 
74,  78-79.  The  FISC  also  reaffirmed  that  the  acquisition  of  foreign  intelligence  information 
under  .section  702  falls  within  the  foreign  intelligence  exception  to  the  warrant  requirement  of  the 
Fourth  Amendment,  and  confirmed  that  nothing  had  disturbed  its  “prior  conclusion  that  the 
government  is  not  required  to  obtain  a  warrant  before  conducting  acquisitions  under  NSA’s 
targeting  and  minimization  procedures.”  Id.  at  69. 


■ffS//SI//NF)  The  FISC  determined,  however,  that  the  minimization  procedures  governing 
relention  of  MCTs  were  inconsistent  with  the  requirements  of  section  702.  The  FISC  found  that 
the  Government  had  not  fully  explored  options  regarding  data  retention  that  would  be  more 
protective  of  U.S.  persons,  and  that  the  FISC  thus  could  not  determine  that  the  Government’s 
minimization  procedures  satisfied  FISA’s  requirement  that  such  procedures  be  “reasonably 
designed”  to  minimize  the  retention  of  protected  U.S.  person  information.  I'he  FISC  further  held 
that,  although  the  Fourth  Amendment’s  warrant  requirement  was  not  implicated,  in  light  of 
NSA’s  proposed  procedures  for  handling  MCTs,  NSA’s  proposed  acquisition  and  minimization 
procedures  did  not  satisfy  the  Fourth  Amendment’s  rea.sonableness  requirement.  The  FISC 
recognized,  however,  that  the  Government  may  be  able  to  “tailor  the  scope  of  NSA’s  upstream 
collection,  or  adopt  more  stringent  post-acquisition  safeguards,  in  a  manner  that  would  satisfy 
the  reasonableness  requirement  of  the  Fourth  Amendment,”  and  suggested  a  number  of 
possibilities  as  to  how  this  might  be  done.  Id.  at  61-63,  78-80. 
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(TS//Sl//^’ir)  On  October  31, 2011,  after  extensive  consultations  among  the  Department,  ODNI, 
and  NSA,  the  Attorney  General  submitted  amended  minimization  procedures  to  the  FISC 
addressing  the  deficiencies  noted  by  the  court.  These  amended  procedures  continue  to  allow  for 
the  upstream  collection  of  MCTs;  however,  they  also  create  more  rigorous  rules  governing  the 
retention  of  MCTs  as  well  as  NSA  analysts’  exposure  to,  and  use  of,  non-targeted 
communications.  On  balance,  NSA  believes  that  the  impact  of  these  procedures  on  operations  is 
acceptable  as  a  necessary  requirement  in  order  to  continue  upstream  collection,  and  that  these 
procedures  will  allow  for  continued  useful  intelligence  collection  and  analysis.  On  November 
30,  the  FISC  granted  the  Government’s  request  for  approval  of  the  amended  procedures,  .stating 
that,  with  regard  to  information  acquired  pursuant  to  201 1  certifications,  “the  government  has 
adequately  corrected  the  deficiencies  identified  in  the  October  3  Opinion,”  and  that  the  amended 
procedures,  when  “viewed  as  a  whole,  meet  the  applicable  statutory  and  constitutional 
requirements.” 

(U)  The  Government  has  provided  copies  of  the  opinions  and  the  filings  by  the  Government  to 
this  Committee,  and  the  Government  will  continue  to  inform  the  Committee  about  developments 
in  this  matter. 
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UNITED  STATES 

FOREIGN  INTELLIGENCE  SURVEILLANCE  COURT 
WASHINGTON,  D.C. 


MEMORANDUM  OPINION 


These  matters  are  before  the  Foreign  Intelligence  Surveillance  Court  (“FISC”  or  “Court”) 
on:  (1)  the  “Government’s  Ex  Parte  Submission  of  Reauthorization  Certification  and  Related 
Procedures,  Ex  Parte  Submission  of  Amended  Certifications,  and  Request  for  an  Order 
Approving  Such  Certification  and  Amended  Certifications”  for  DNI/AG  702(g)  Certifications 

TOPSECRET//COfllINT//ORCO?I,NOrORN 
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-JFOPSE€:RET//COA!nNT//ORCON)WOFOH« — 
||||||||||[[|[|||[||||||||||^^  which  was  filed  on  April  20, 2011;  (2)  the  “Govermnent’s  Ex  Parte 
Submission  of  Reauthorization  Certification  and  Related  Procedures,  Ex  Parte  Submission  of 
Amended  Certifications,  and  Request  for  an  Order  Approving  Such  Certification  and  Amended 
Certifications’^  for  DNl/AG  702(g)  Certifications  |[[||||||||||||||||||||^^||||[[^^  which 

was  filed  on  April  22, 2011;  and  (3)  the  “Government’ s  Ex  Parte  Submission  of  Reauthorization 
Certification  and  Related  Procedures,  Ex  Parte  Submission  of  Amended  Certifications,  and 
Request  for  an  Order  Approving  Such  Certification  and  Amended  Certifications”  for  DNI/AG 
702(g)  C<^ifications|^^^^|HHHHHHlH>  which  was  also  filed  on  April  22, 
2011.’ 

Through  these  submissions,  the  government  seeks  approval  of  the  acquisition  of  certain 
telephone  and  Internet  communications  pursuant  to  Section  702  of  the  Foreign  Intelligence 
Surveillance  Act  (“FISA”  orthe  “Act”),  50  U.S.C.  §  1881a,  which  requires  judicial  review  for 
compliance  with  both  statutory  and  constitutional  requirements.  For  the  reasons  set  forth  below, 
the  government’s  requests  for  approval  are  granted  in  part  and  denied  in  part.  The  Court 
concludes  that  one  aspect  of  the  proposed  collection  -  the  “upstream  collection”  of  Internet 
transactions  containing  multiple  communications  -  is,  in  some  respects,  deficient  on  statutory 
and  constitutional  grounds. 


'  For  ease  of  reference,  the  Court  will  refer  to  these  three  filings  collectively  as  the  “April 
2011  Submissions.” 
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I,  all  of  which  were  executed  by  the  Attorney 


Gaieral  and  the  Director  of  National  Intelligence  (“DNI”)  pursuant  to  Section  702,  HI 
previous  certifications  have  been  submitted  fay  the  government  and  approved  fay  the  Court 

to  702.  HHHHHHIHHHIIIIi^HIHHiilHiHlli^^H 

(collectively,  the 

Dockets”).  Each  of  the  April  201 1  Submissions  also  includes  supporting  affidavits  by  the 
Director  or  Acting  Director  of  the  National  Security  Agency  CT^SA”),  the  Director  of  the  Federal 
Bureau  of  Investigation  (“FBI”),  and  the  Director  of  the  Central  Intelligence  Agency  (“CIA”); 
two  sets  of  targeting  procedures,  for  use  by  NS  A  and  FBI  respectively;  and  three  sets  of 
minimization  procedures,  for  use  by  NS  A,  FBI,  and  CIA,  respectively.^ 

Like  the  acquisitions  approved  by  the  Court  in  the  eight  Prior  702  Dockets,  collection 


^  The  targeting  and  minimization  procedures  accompanying  Certification  HHI  are 
identical  to  those  accompanying  |||||||^HHHHHII||||||||^HIHHH^^^^I  discussed 

below,  the  NSA  targeting  procedures  and  FBI  minimization  procedures  accompanying 
Ceitiflcations  dlso  are  identical  to  the  NSA  targeting  procedures 

and  FBI  minimization  procedures  that  were  submitted  by  the  government  and  approved  by  the 
Court  for  use  in  connection  with  Certifications  targeting 

pro  cedures  and  the  N S A  and  CIA  minimization  procedures  that  accompany  the  April  2011 


Submissions  differ  in  several  respects  from  the  corresponding  procedures  that  were  submitted  by 
the  government  and  approved  by  the  Court  in  connection  with  Certifications 


NSA-WIKI  00151 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  566  of  1298 


-TOP  SECRET//COMINT//ORCON,NOFORN 


The  April  2011  Submissions  also  include  amendments  to  certifications  that  have  been 
submitted  by  the  government  and  approved  by  the  Court  in  the  Prior  702  Dockets.  The 
amendments,  which  have  been  authorized  by  the  Attorney  General  and  the  DNI,  provide  that 
information  collected  under  the  certifications  in  the  Prior  702  Dockets  will,  effective  upon  the 


Court’s  approval  of  Certifications) 


|,  be  handled  subject  to  the  same 
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revised  NSA  and  CIA  minimization  procedures  that  have  been  submitted  for  use  in  connection 

Certifications 


On  May  2, 2011,  the  government  filed  with  the  Couit  a  letter  pursuant  to  FISC  Rule  13(a) 
titled  “Clarification  of  National  Security  Agency’s  Upstream  Collection  Pursuant  to  Section  702 
of  FISA”  (“May  2  Letter”),  The  May  2  Letter  disclosed  to  the  Court  for  the  first  time  that  NSA’s 
“upstream  collection”^  of  Internet  communications  includes  the  acquisition  of  entire 
“transaction[s]”||||||||||[[[|||||||||[||^|^|||||||||||[|||||||||||||||||||^^ 

According  to  tlic  May  2  Letter,  such  transactions  may  contain  data  that  is  wholly 
unrelated  to  the  tasked  selector,  including  the  full  content  of  discrete  communications  that  are  not 
to,  from,  or  about  the  facility  tasked  for  collection.  Se§  id  at  2-3 .  The  letter  noted  that  NSA 

ensure 

“the  person  from  whom  it  seeks  to  obtain  foreign  intelligence  information  is  located  overseas,” 
but  suggested  that  the  government  might  lack  confidence  in  the  effectiveness  of  such  measures  as 
applied  to  Internet  transactions.  See  |d  at  3  (citation  omitted). 

^  The  term  “upstream  collectionj^referstoNSA^sintraceptionofhitere^^^^^^^ 
commi^cations  astheyfransit^||||||^^||||||||||||||||||||||||||||^^|||||||[^^ 

IBHLiather  tlm  to  acquisiti^  directly  from  Internet  service  providers  suchas^^^B^^ 


■*  The  concept  of  “Internet  transactions”  is  discussed  more  fully  below,  gge  infra,  pages 
27-41  and  note  23, 
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C.  The  Govemmeat’s  First  Motion  for  Extensions  of  Time 

On  May  5, 201 1 ,  the  government  filed  a  motion  seeking  to  extend  until  July  22, 201 1 ,  the 
30-day  periods  in  which  the  Court  must  otherwise  complete  its  review  of  Certifications 

amendments  to  the  certifications  in  the  Prior  702  Dockets. 

Motion  for  an  Order  Extending  Time  Limit  Pursuant  to  50  U.S.C.  §  1881a(j)(2)  at  1  (“May 
Motion”).  The  period  for  FISC  review  of  Certification 

was  then  set  to  expire  on  May  20, 201 1,  and  the  period  for 
review  of  the  other  pendmg  certifications  and  amendments  was  set  to  expire  on  May  22,  2011. 

Id  at  6.* 

The  government  noted  in  the  May  Motion  that  its  efforts  to  address  the  issues  raised  in 
the  May  2  Letter  were  still  ongoing  and  that  it  intended  to  "supplement  the  recoid  ...  in  a 
manner  that  will  aid  the  Court  in  its  review”  of  the  certifications  and  amendments  and  in  making 
the  determinations  required  under  Section  702.  Id  at  7.  According  to  the  May  Motion,  however, 
the  government  would  “not  be  in  a  position  to  supplement  the  record  until  after  the  statutory  time 
limits  for  such  review  have  expired.”  The  government  further  asserted  that  granting  the 
requested  extension  of  time  would  be  consistent  with  national  security,  because,  by  operation  of 


^  50  U.S.C.  §  1881a(i)(l)(B)  requires  the  Court  to  complete  its  review  of  the  certification 
and  accompanying  targeting  and  minimization  procedures  and  issue  an  order  under  subsection 
1 88  la(i)(3)  not  later  than  30  days  after  the  date  on  which  the  certification  and  procedures  are 
submitted.  Pursuant  to  subsection  1 88  la(i)(l)(C),  the  same  time  limit  applies  to  review  of  an 
amended  certification  or  amended  procedures.  However,  50  U.S.C.  §  I881a0)(2)  permits  the 
Court,  by  order  for  reasons  stated,  to  extend  “as  necessary  for  good  cause  in  a  manner  consistent 
with  national  security,”  the  time  limit  for  the  Court  to  complete  its  review  and  issue  an  order 
under  Section  1881a(i)(3). 
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statute,  the  government’s  acquisition  of  foreign  mtelligence  information  under  Certifications 
|||[||||||||^^  could  continue  pending  completion  of  the  Court’s  review.  ^  id. 

at  9-10. 


On  May  9, 201 1,  the  Court  entered  orders  granting  the  government’s  May  Motion,  Based 
upon  the  representations  in  the  motion,  the  Court  found  that  there  was  good  cause  to  extend  the 
time  limit  for  its  review  of  the  certifications  to  July  22, 201 1,  and  that  the  extensions  were 
consistent  with  national  security.  May  9, 201 1  Orders  at  4. 

D.  The  May  9  Briefing  Order 

Because  it  appeared  to  the  Court  that  the  acquisitions  described  in  the  May  2  Letter 
exceeded  the  scope  of  collection  previously  disclosed  by  the  government  and  approved  by  the 
Court,  and  might,  in  part,  fall  outside  the  scope  of  Section  702,  the  Court  issued  a  Briefing  Order 
on  May  9, 201 1  ("Briefing  Order”),  in  which  it  directed  the  government  to  answer  a  number  of 
questions  in  writing.  Briefing  Order  at  3-5,  On  June  1 , 201 1 ,  the  United  States  filed  the 
“Government’s  Response  to  the  Court’s  Briefing  Order  of  May  9, 2011”  (“June  1  Submission”). 
After  reviewing  the  June  1  Submission,  the  Court,  through  its  staff,  directed  the  government  to 
answer  a  number  of  follow-up  questions.  On  June  28, 201 1,  the  government  submitted  its 
written  responses  to  the  Court’s  follow-up  questions  in  the  “Government’s  Response  to  the 
Court’s  Follow-Up  Questions  of  June  17, 201 1”  (“June  28  Submission”). 

E,  The  Government’s  Second  Motion  for  Extensions  of  Time 

The  Court  met  with  senior  officials  of  the  Department  of  Justice  on  July  8, 201 1,  to 
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discuss  the  information  provided  by  the  government  in  the  June  1  and  June  28  Submissions, 
During  the  meeting,  the  Court  informed  the  government  that  it  still  had  serious  concerns 
regarding  NSA’s  acquisition  of  Internet  transactions  and,  in  particular,  whether  the  Court  could 
make  the  findings  necessary  to  approve  the  acquisition  of  such  transactions  pursuant  to  Section 
702.  The  Court  also  noted  its  willingness  to  entertain  any  additional  filings  that  the  government 
might  choose  to  make  in  an  effort  to  address  those  concerns. 

On  July  14, 201 1,  the  government  filed  a  motion  seeking  additional  sixty-day  extensions 
of  the  periods  in  which  the  Court  must  complete  its  review  of  DNI/AG  702(g)  Certifications 

,  and  the  amendments  to  the  certifications  in  the  Prior  702  Dockets. 
Motion  for  Ordem  Extendmg  Time  Limits  Pursuant  to  50  U.S.C.  §  1881a(j)(2)  (“July  Motion”).* 

In  its  July  Motion,  the  government  indicated  that  it  was  in  the  process  of  compiling 
additional  information  regarding  the  nature  and  scope  of  NSA’s  upstream  collection,  and  that  it 
was  “examining  whether  enhancements  to  NSA’s  systems  or  processes  could  be  made  to  fiirther 
ensure  that  information  acquired  through  NSA’s  upstream  collection  is  handled  in  accordance 
with  the  requirements  of  the  Act.”  li  at  8.  Because  additional  time  would  be  needed  to 
supplement  the  record,  however,  the  government  represented  that  a  60-day  extension  would  be 
necessary,  Id  at  8, 1 1 .  The  government  argued  that  granting  the  request  for  an  additional 
extension  of  time  would  be  consistent  with  national  security,  because,  by  operation  of  statute,  the 


®  As  discussed  above,  by  operation  of  the  Court’s  order  of  May  9, 2011,  pursuant  to  50 
U.S.C,  §  1881a(j)(2),  the  Court  was  required  to  complete  its  review  of,  and  issue  orders  under  50 
U.S.C.  §  1881a(i)(3)  concerning,  DNI/AG  702(g)  Certification^||||||||||||||[^^ 
and  the  amendments  to  the  certifit^tions  in  the  Prior  702  Dockets,  by  July  22, 2011.  li  at  6. 
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government’s  acquisition  of  foreign  intelligence  information  under  Certifications  HHUH 

jjjllllllllllllll^^  continue  pending  completion  of  the  Court’s  review.  at  9-1 0. 

On  July  1 4, 2011 ,  the  Court  entered  orders  granting  the  government’ s  motion.  Based 
upon  the  representations  in  the  motion,  the  Court  found  that  there  was  good  cause  to  extend  the 
time  limit  for  its  review  of  the  certifications  to  September  20, 2011,  and  that  the  extensions  were 
consistent  with  national  security.  July  14, 201 1  Orders  at  4. 

F.  The  Ausfust  16  and  August  30  Submissions 

On  A\^st  16, 2011,  the  government  filed  a  supplement  to  the  June  1  and  .Tune  28 
Submissions  ("August  16  Submission”).  In  the  August  16  Submission,  the  government 
described  the  results  of  "a  manual  review  by  [NSA]  of  a  statistically  representative  sample  of  the 
nature  and  scope  of  the  Internet  communications  acquired  through  NSA’s  •. . .  Section  702 
upstream  collection  during  a  six-month  period.”  Notice  of  Filing  of  Aug.  16  Submission  at  2. 
Following  a  meeting  between  the  Court  staff  and  representatives  of  the  Department  of  Justice  on 
August  22, 2011,  the  government  submitted' a  further  filing  on  August  30, 201 1  (“August  30 
Submission”). 

G.  The  Hearing  and  the  Government’s  Final  Written  Submission 

Following  review  of  the  August  30  Submission,  the  Court  held  a  hearing  on  September  7, 
201 1 ,  to  ask  additional  questions  of  NSA  and  the  Department  of  Justice  regarding  the 
government’s  statistical  analysis  and  the  implications  of  that  analysis.  The  government  made  its 
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final  written  submissions  on  September  9, 201 1,  and  September  13, 201 1  (“September  9 
Submission”  and  “September  13  Submission,”  respectively), 


On  September  14,  201 1,  the  Court  entered  orders  further  extending  the  deadline  for  its 
completion  of  the  review  of  the  certifications  and  amendments  filed  as  part  of  the  April 
Submissions.  The  Court  explained  that  “[g]iven  the  complexity  of  the  issues  presented  in  these 
matters  coupled  vdth  the  Court’s  need  to  fully  analyze  the  supplemental  information  provided  by 
the  government  bi  recent  filings,  the  last  of  which  was  submitted  to  the  Court  on  September  13, 
2011,  the  Court  will  not  be  able  to  complete  its  review  of,  and  issue  orders . . .  concerning  [the 
certifications  and  amendments]  by  September  20, 201 1 


Plllllllll^^  The  Court  further  explained  that  although  it  had  originally 

intended  to  extend  the  deadline  by  only  one  week,  the  government  had  advised  the  Court  that 
“for  technical  reasons,  such  a  brief  extension  would  compromise  the  government’s  ability  to 
ensure  a  seamless  transition  from  one  Certification  to  the  next.”  |H|||||^hh|||||||hhh 


Accordingly,  the  Court  extended  the  deadline  to  October  1 0, 
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U.  REVIEW  OF  CERTIFICATIONS 

The  Court  must  review  a  certification  submitted  pursuant  to  Section  702  of  FISA  “to 
determine  whether  [it]  contains  all  the  required  elements.”  50  U.S.C.  §  1881a(i)(2)(A).  The 
Court’s  examination  of  Certifications  that: 

(1)  the  certifications  have  been  made  under  oath  by  the  Attorney  General  and  the  DNI,  as 
required  by  50  U.S.C.  §  1881a(g)(I)(A),  |ee  Certificafion|||||||||||||^^ 

(2)  the  certifications  contain  each  of  the  attestations  required  by  50  U.S.C. 

§  1881a(g)(2)(A),  see  Certification 

^^llllllllllllllllllll^^ 

(3)  as  required  by  50  U.S.C.  §  1881a(g)(2)(B),  each  of  the  certifications  is  accompanied 
by  the  applicable  targeting  procedures"'  and  minimization  procedures;* 

(4)  each  of  the  certifications  is  supported  by  the  affidawts  of  appropriate  national  security 
officials,  as  described  in  50  U.S.C.  §  1881a(g)(2)(C);’  and 

(5)  each  of  the  certifications  includes  an  effective  date  for  the  authorization  in  compliance 
’  April  2011  Submissions,  NSA  Targeting  Procedures  and  FBI  Targeting  Procedures 

(attached  to  Certifications  ||||||||||||||||||^||HHHHBH1HHHHHBI^^ 

*  April  20!  1  Submissions,  NSA  Minimization  Procedures,  FBI  Minimization 
Procedures,  and  CIA  Minimization  Procedures  (attached  to  Certifications 
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withSOU.S.C.  §  1881a(g)a)(D),§gsCertificationH^H^H 

10 


The  Court  therefore  finds  that  Certificatior 

^^^Bcontain  all  the  required  elements.  SOU.S.C.  §  1881a(i)(2)(A). 

in.  REVIEW  OF  THE  AMENDMENTS  TO  THE  CERTIFICATIONS  IN  THE  PRIOR 

DOCKETS. 


Under  the  judicial  review  procedures  that  apply  to  amendments  by  virtue  of  Section 
1 881a(i)(l)(C),  the  Court  must  review  each  of  the  amended  certifications  “to  determine  whether 
the  certification  contains  all  the  required  elranents.”  50  U.S.C.  §  1881a(i)(2)(A).  The  Court  has 
previously  determined  that  the  certifications  in  each  of  the  Prior  702  Dockets^  as  originally 
submitted  to  the  Court  and  previously  amended,  contained  all  the  required  elements.' '  Like  the 
prior  certifications  and  amendments,  the  amendments  now  before  the  Court  were  executed  under 
oath  by  the  Attorney  General  and  the  DNI,  as  required  by  50  U.S.C.  §  1881a(g)(l)(A),  and 
submitted  to  tlie  Court  within  the  time  allowed  under  50  U.S.C.  §  1881a(i)(l)(C).  Ssg 


The  statement  described  in  50  U.S.C.  §  1 88  la(g)(2)(E)  is  not  required  in  this  case 
because  there  has  been  no  “exigent  circumstances”  determination  under  Section  1881a(c)(2), 
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Certificatior 


Pursuant 


to  Section  l881a(g)(2)(A)(ii),  the  latest  amendments  include  the  attestations  of  the  Attorney 
General  and  the  DNI  that  the  accompanying  NS  A  and  CIA  minimuation  procedures  meet  the 
statutory  definition  of  minimization  procedures,  are  consistent  with  the  requirements  of  the 
Fourth  Amendment,  and  will  be  submitted  to  the  Court  for  approval,  CertificationB||||||||||H 
||||||||||[|||||[|||||||||||||||||||||||||^^  The  latest  amendments  also 

include  effective  dates  that  comply  with  50  U.S.C.  §  1 88 1  a(g)(2)P)  and  §  1 881  a(i)(l). 


Certification  I 


All  other  aspects 


of  the  certifications  in  the  Prior  702  Dockets  ~  including  the  further  attestations  made  therein  in 
accordance  with  §  1 881a(g)(2)(A),  the  NS  A  targeting  procedures  and  FBI  minimization 
procedures  submitted  therewith  in  accordance  with  §  1881  a(g)(2)(B),'^  and  the  affidavits 
executed  in  support  thereof  in  accordance  with  §  1 88  la(g)(2)(C)  -  are  unaltered  by  the  latest 
amendments. 

In  light  of  the  foregoing,  the  Court  finds  that  the  certifications  in  the  Prior  702  Dockets, 
as  amended,  each  contain  all  the  required  elements.  50  U.S.C.  §  1881a(i)(2)(A). 


The  amendments  to  the  certifications  in  the  Prior  702  Dockets  were  approved  by  the 
Attorney  General  on  April  1 1, 201 1,  and  by  the  DNI  on  April  13, 20 1 1 .  See  Certification 


Of  course,  targeting  under  the  certifications  filed  in  the  Prior  702  Dockets  will  no 
longer  be  permitted  following  the  Courtis  issuance  of  an  order  on  Ceiiifications|HH|[||||H 
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IV.  REVIEW  OF  THE  TARGETING  AND  MINIMIZATION  PROCEDURES 

The  Court  is  required  to  review  the  targeting  and  minimization  procedures  to  determine 
whether  they  are  consistent  with  the  requirements  of  50  U.S.C,  §  1881a(d)(l)  and  (e)(1). 

50  U.S.C.  §  1881a(i)(2)(B)  and  (C);  see  also  50  U.S.C.  §  1881a(i)(l)(C)  (providing  that  amended 
procedures  must  be  reviewed  under  the  same  standard).  Section  1881a(d)(l)  provides  that  the 
targeting  procedures  must  be  “reasonably  designed”  to  “ensure  that  any  acquisition  authorized 
under  [the  certification]  is  limited  to  targeting  persons  reasonably  believed  to  be  located  outside 
the  United  States”  and  to  “prevent  the  intentional  acquisition  of  any  communication  as  to  which 
the  sender  and  all  intended  recipients  are  known  at  the  time  of  the  acquisition  to  be  located  in  the 
United  States.”  Section  1881a(e)(l)  requires  that  the  minimization  procedures  “meet  the 

definition  of  minimization  procedures  under  [50  U.S.C.  §§]  1801(h)  or  1821(4) _ ”  Most 

notably,  that  definition  requires  “specific  procedures,  which  shall  be  adopted  by  the  Attorney 
General,  that  are  reasonably  designed  in  light  of  the  purpose  and  technique  of  the  particular 
[surveillance  or  physical  search],  to  minimize  the  acquisition  and  retention,  and  prohibit  the 
dissemination,  of  nonpublicly  available  information  concerning  unconsenting  United  States 
persons  consistent  with  the  need  of  the  United  States  to  obtain,  produce,  and  disseminate  foreign 
intelligence  information."  50  U.S.C.  §§  1801(h)  &  1821(4).  Finally,  the  Court  must  determine 
whether  the  targeting  and  minimization  procedures  are  consistent  with  the  requirements  of  the 
Fourth  Amendment.  50  U.S.C.  §  1881a(i)(3)(A). 
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The  Court’s  review  of  the  targeting  and  minimization  procedures  submitted  with  the 
April  2011  Submissions  Is  complicated  by  the  govenunent’s  recent  revelation  that  NSA’s 
acquisition  of  Internet  communications  through  its  upstream  collection  under  Section  702  is 
accomplished  by  acquiring  Internet  “transactions,”  which  may  contain  a  single,  discrete 
communication,  or  multiple  discrete  commxinications,  including  communications  that  are  neither 
to,  from,  nor  about  targeted  fecilities.  June  1  Submission  at  1-2.  That  revelation  fundamentally 
alters  the  Court’s  understanding  of  the  scope  of  the  collection  conducted  pursuant  to  Section  702 
and  requires  careful  reexamination  of  many  of  the  assessments  and  presumptions  underlying  its 
prior  approvals. 

In  the  first  Section  702  docket,  government  disclosed  that 

its  Section  702  collection  would  include  both  telephone  and  Internet  communications. 

According  to  the  government,  the  acquisition  of  telephonic  communications  would  be  limited  to 
“to/from”  communications  -  Lgi,  communications  to  or  from  a  tasked  fricility.  The  government 
explained,  however,  that  the  Internet  communications  acquired  would  include  both  to/from 
communications  and  “about”  communications  -  Lfii,  communications  containing  a  reference  to 
the  name  the  tasked  account.  ggg|||||||||||||||||||||||||||||||||||||^^ 

Based  upon  the  government’s  descriptions  of  the  proposed  collection,  the  Court  understood  that 
the  acquisition  of  Internet  communications  under  Section  702  would  be  limited  to  discrete 
“to/from”  communications  between  or  among  individual  account  users  and  to  “about” 
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conmunications  falling  withirUJ  specific  categories  that  had  been  first  described  to  the  Court 


approval  of  the  targeting  and  minimization  procedures  in  Docket  No.  |||||||||||^^ 
otheimil  Prior  702  Dockets,  depended  upon  the  government’s  representations  regarding  the 
scope  of  the  collection.  In  conducting  its  rtvkw  and  granting  those  approvals,  the  Court  did  not 
take  into  account  NSA’s  acquisition  of  Internet  transactions,  which  now  materially  and 
fiindamentally  alters  the  statutory  and  constitutional  analysis.'"' 


The  Court  is  troubled  that  the  government’s  revelations  regarding  NSA’s  acquisition 
of  Internet  transactions  mark  the  third  instance  in  less  than  three  years  in  which  the  government 
has  disclosed  a  substantial  misrepresentation  regarding  the  scope  of  a  major  collection  program. 

In  March,  2009,  the  Court  concluded  that  its  authorization  of  NSA’s  bulk  acquisition  of 
telephone  call  detail  records  fi^om^HIHBHHHB  so-called  “big  business 
records”  matter  “ha[d]  been  premised  on  a  flawed  depiction  of  how  the  NS  A  uses  [the  acquired] 
metadata,”  and  that  ‘‘[tjhis  misperception  by  the  FISC  existed  from  the  inception  of  its  authorize 
collection  in  May  2006,  buttressed  by  repeated  inaccurate  statements  made  in  the  government’s 
submissions,  and  despite  a  government-devised  and  Court-mandated  oversight  regime.”  Docket 
No.  BR  08- 13,  March  2, 2009  Order  at  10-1 1 .  Contrary  to  the  government’s  repeated 
assurances,  NSA  had  been  routinely  running  queries  of  the  metadata  using  querying  terms  that 
did  not  meet  the  required  standard  for  querying.  The  Court  concluded  that  this  requirement  had 
been  “so  frequently  and  systemically  violated  tiiat  it  can  feirly  be  said  that  this  critical  element  of 
the  overall . . .  regime  has  never  functioned  effectively.”  Id. 

Shortly  thereafter,  the  government  made  a  similar  disclosure  regarding  NSA’s  bulk 
acgriisition  of  metadata  regarding  Internet  communications  in  the  so-called  “big  pen  register” 
matter.  In  the  government  reported  that,  from  tlie  time  of  the  initial  Court 

authorization  in  2004,  NSA  had  been  continually  collecting  various  forms  of  data  falling  outside 
the  scope  of  the  Court’s  orders,  and  that  [vjirtually  every  PR/TT  record’  generated  by  this 

some  data  that  had  not  been  authorized  for  collection.”  Docket  No.  PR/TT  HH 
Mem.  Op.  at  20-21.  This  long-running  and  systemic  overcoilection  had 

(continued...) 
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The  government’s  submissions  make  clear  not  only  that  NSA  has  been  acquiring  Internet 

transactions  since  before  the  Court’s  approval  of  the  first  Section  702  certification  in  2008,"  but 
also  that  NSA  seeks  to  continue  the  collection  of  Internet  transactions.  Because  NSA’s 
acquisition  of  Internet  transactions  presents  difficult  questions,  the  Court  will  conduct  its  review 
in  two  stages.  Consistent  with  the  approach  it  has  followed  in  past  reviews  of  Section  702 
certifications  and  amendments,  the  Court  will  first  consider  the  targeting  and  minimization 
procedures  as  applied  to  the  acquisition  of  communications  other  than  Internet  transactions  -  i.e.. 
to  the  discrete  communications  between  or  among  the  users  of  telephone  and  Internet 
communications  facilities  that  are  to  or  from  a  facility  tasked  for  collection.’*  The  Court  will 


“(...continued)  _ 

occurred  despite  the  government’s  repeated  assurances  over  the  course  of  nearly  djyears  that 

authorizations  granted  by  docket  number 
PR/nm  and  previous  docket  numbers  only  collect,  or  collected,  authorized  metadata.”  Id. 
at  20,  The  o-vercoUection  was  not  detected  by  NSA  until  after  an  “end-to-end  review”  of  the 
PR/TT  metadata  program  that  had  been  completed  by  the  agency  on  August  1 1 , 2009.  Id. 


“  The  government’s  revelations  regarding  the  scope  of  NSA’s  upstream  collection 
implicate  50  U.S.C.  §  1 809(a),  which  makes  it  a  crime  (1)  to  “engageQ  in  electronic  surveillance 
under  color  of  law  except  as  authorized”  by  statute  or  (2)  to  “disclose[]  or  usel]  information 
obtained  under  color  of  law  by  electronic  surveillance,  knowing  or  having  reason  to  know  that 
the  information  was  obtained  through  electronic  surveillance  not  authorized”  by  statute.  See 

lllljllllllllllllllllllll^^  (concluding 

1 809(a)(2)  precluded  the  Court  fmm  approving  the  government’s  proposed  use  of,  among  other 
thmgs,  certain  data  acquired  by  NSA  without  statutory  authority  through  its  “upstream 
collection”).  The  Court  will  address  Section  1809(a)  and  related  issues  in  a  separate  order. 


“  As  noted,  the  Court  previously  authorized  the  acquisition  oflllll  categories  of  “about” 
communications.  The  Court  now  understands  that  all  “about”  communications  are  acquired  by 
means  of  NSA’s  acquisition  of  Internet  transactions  through  its  upstream  collection.  June  1 
Submission  at  1-2,  see  also  Sept.  7, 201 1  Hearing  Tr.  at  76.  Accordingly,  the  Court  considei's  the 

(continued...) 


TQP-SECRE.T//COMINT//ORCON,NOFeRN 


Page  17 


NSA-WIKI  00165 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  580  of  1298 


-TOP  SECRET//CORflNT//ORCON,NQFQaiV 
then  assess  the  effect  of  the  recent  disclosures  regarding  NS  A’ s  collection  of  Internet  transactions 

on  its  ability  to  make  the  findings  necessary  to  approve  the  certifications  and  the  NSA  targeting 
and  minimization  procedures.’’ 

B.  The  Unmodified  Procedures 

The  government  represents  that  the  NSA  targeting  procedures  and  the  FBI  minimization 
procedures  filed  with  the  April  201 1  Submissions  are  identical  to  the  corresponding  procedures 
that  were  submitted  to  the  Court  in  Docket  Nos. 


I  IB 


The  Court  has  reviewed  each  of  these  sets  of  procedures  and  confirmed  that  is  the  case,  hi  fact, 
the  NSA  targeting  procedures  and  FBI  minimization  procedures  now  before  the  Court  are  copies 


_  ’^(...continued) 

I^Pcategories  of  “about”  communications  to  be  a  subset  of  the  Internet  transactions  that  NSA 
acquires.  Hie  Court’s  discussion  of  the  manner  in  which  the  government  proposes  to  apply  its 
targeting  and  minimization  procedures  to  Internet  transactions  generally  also  applies  to  the||[||||| 
categories  of  “about”  communications.  Ssg  infra,  pages  41-79. 

”  The  FBI  and  the  CIA  do  not  receive  unminimized  communications  that  have  been 
acquired  through  NSA’s  upstream  collection  of  Internet  communications.  Sept.  7, 201 1  Hearing 
Tr.  at  61-62.  Accordingly,  the  discussion  of  Internet  transactions  that  appears  below  does  not 
affect  the  Court’s  conclusions  that  the  FBI  targeting  procedures,  the  CIA  minimization 
procedures,  and  the  FBI  minimization  procedui-es  meet  the  statutory  and  constitutional 
requirements. 


Sss  Government’s  Ex  Parte  Submission  of  Reauthorization  Certification  and  Related 
Procedures,  Ex  Parte  Submission  of  Amended  Certifications,  and  Request  for  an  Order 
Approving  Such  Certification  and  Amended  Certifications  for  DNI/AG  702(g)  Certifications 
gllllllllllllll  Government’s  Ex  Parte  Submission  of  Reauthorization 

Certification  and  Related  Procedures,  Ex  Parte  Submission  of  Amended  Certifications,  and 
Request  for  an  Order  Approving  Such  Certification  and  Amended  Certifications  for  DNI/AG 


702(g)  Certifications! 


j;  Government’s  Ex  Parte 


Submission  of  Reauthorization  Certification  and  Related  Procedures,  Ex  Parte  Submission  of 
Amended  Certifications,  and  Request  for  an  Order  Approving  Such  Certification  and  Amended 
Certifications  for  DNI/AG  702(g)  Gertifications|H||||||[H^H|H||||||||^^ 
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consistent  with  the  requirements  of  50  U.S.C.  §  1881a(d)-(e)  and  with  the  Fourth  Amendment. 
See  Docket  No.  |||||||||||||||||||||m 


The  Court  is  prepared  to  renew  its  past  findings  that  the  NSA  targeting  procedures 
(as  applied  to  forms  of  to/from  communications  that  have  previously  been  described  to  the 
Court)  and  the  FBI  minimization  procedures  are  consistent  with  the  requirements  of  50  U.S.C.  § 
1 881a(d)-(e)  and  with  the  Fourth  Amendment.^® 

C.  The  Amended  Procedures 

As  noted  above,  the  FBI  targeting  procedures  and  the  NSA  and  CIA  minimization 
procedures  submitted  with  the  April  2011  Submissions  differ  in  a  number  of  respects  from  the 
corresponding  procedures  that  were  submitted  by  the  government  and  approved  by  the  Court  in 
connection  with  Certifications  ^||||||||||||||^^  reasons  that  follow,  the 

Court  finds  that,  as  applied  to  the  previously  authorized  collection  of  discrete  communications  to 
or  from  a  tasked  facility,  the  amended  FBI  targeting  procedures  and  the  amended  NSA  and  CIA 


also  submitted  in  Docket  Nos.  |^|||[|||||||||^ 

®  The  Court  notes  that  the  FBI  minimization  procedures  are  not  “set  forth  in  a  clear  and 
self-contained  manner,  without  resort  to  cross-referencing,”  as  required  by  FISC  Rule  12,  which 
became  effective  on  November  1, 201 0.  The  Court  expects  that  fbture  submissions  by  the 
government  will  comport  with  this  requirement. 
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minimization  procedures  are  consistent  with  the  requirements  of  50  U.S.C.  §  1881a(d)-(e)  and 
with  the  Fourth  Amendment. 

1.  The  Amended  FBI  Targeting  Procedures 
The  government  has  made  three  changes  to  the  FBI  targeting  procedures,  all  of  which 


by  the  fact  that  I 


The  government  has  advised  the  Court  that  this  change  was  prompted 


Nevertheless, 

.  The  change  is  intended  to 


the  current  procedures  require  the  FBI  to 
eliminate  the  requirement  of] 

The  second  change,  reflected  in  subparagraph  (a)  of  Section  1.4,  would  allow  the  FBI, 
under  circumstances, 
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The  above-described  changes  to  the  FBI  targeting  procedures  pose  no  obstacle  to  a 
finding  by  the  Court  that  the  FBI  targeting  procedures  are  “reasonably  designed”  to  “ensure  that 
any  acquisition  authorized ...  is  limited  to  targeting  persons  reasonably  believed  to  be  located 
outside  the  United  States”  and  to  “prevent  die  intentional  acquisition  of  any  communication  as  to 
which  the  sender  and  all  intended  recipients  are  known  at  the  time  of  the  acquisition  to  be  located 
in  the  United  States”  50U.S.C.  §  188ia(d)(l}.  ^^^_hh|||||||||h 
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Furthermore,  as  the  Court  has  previously  noted,  before  the  FBI  targeting  procedures  are 
applied,  NSA  will  have  followed  its  own  targeting  procedures  in  determining  that  the  user  of  the 
facing  to  be  tasked  for  collection  is  anon-United  States  person  reasonably  believed  to  be  located 
outside  the  United  States.  See  Docket  No. 


Id.  Tlie  Court  has  previously  found  that  the  NSA  targeting 
procedures  proposed  for  use  in  connection  with  Certifications 
reasonably  designed  to  ensure  that  the  users  of  tasked  selectors  are  non-United  States  persons 
reasonably  believed  to  be  located  outside  the  United  States  and  also  consistent  with  the  Fourth 


Amendment.  See  Docket  No 


It  therefore  follows  that  the 


amended  FBI  targeting  procedures,  which  provide  additional  assurance  that  the  users  of  tasked 
accounts  are  non-United  States  persons  located  outside  the  United  States,  also  pass  muster. 


'zation  Pr 


The  most  significant  change  to  the  NSA  minimization  procedures  regards  the  rules  for 
querying  the  data  that  NSA  acquires  pursuant  to  Section  702.  The  procedures  previously 
approved  by  the  Court  effectively  impose  a  wholesale  bar  on  queries  using  United  States-Person 
identifiers.  The  government  has  broadened  Section  3(b)(5)  to  allow  NSA  to  query  the  vast 
majority  of  its  Section  702  collection  using  United  States-Person  identifiers,  subject  to  approval 
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pursuant  to  internal  NS  A  procedures  and  oversight  by  the  Department  of  Justice.^'  Like  all  olher 

NSA  queries  of  the  Section  702  collection,  queries  using  United  States-person  identifiers  would 
be  limited  to  those  reasonably  likely  to  yield  foreign  intelligence  information.  NSA 
Minimization  Procedures  §  3(b)(5).  The  Department  of  Justice  and  the  Office  of  the  DNI  would 
be  required  to  conduct  oversight  regarding  NSA’s  use  of  United  States-person  identifiers  in  such 
queries.  See  id. 

This  relaxation  of  the  querying  rules  does  not  alter  the  Court’s  prior  conclusion  that  NSA 
minimization  procedures  meet  the  statutory  definition  of  minimization  procedures.  The  Standard 
Minimization  Procedures  for  FBI  Electronic  Surveillance  and  Physical  Search  Conducted  Under 
the  Foreign  Intelligence  Surveillance  Act  (“FBI  SMPs”)  contain  an  analogous  provision  allowing 
queries  of  unminimized  FISA-acquired  information  using  identifiers  -  including  United  States- 
person  identifiers  -  when  such  queries  are  designed  to  yield  foreign  intelligence  information. 

See  FBI  SMPs  §  III.D.  In  granting  hundreds  of  applications  for  electronic  surveillance  or 
phj^ical  search  since  2008,  including  applications  targeting  United  States  persons  and  persons  in 
the  United  States,  the  Court  has  found  that  the  FBI  SMPs  meet  the  definitions  of  minimization 
procedures  at  50  U.S.C.  §§  1801(h)  and  1821(4).  It  follows  that  the  substantially-similar 


The  government  is  still  in  the  process  of  developing  its  internal  procedures  and  will 
not  permit  NSA  analysts  to  begin  using  United  States-person  identifiers  as  selection  terms  until 
those  procedures  are  completed.  Jime  28  Submission  at  4  n.3.  In  addition,  the  government  has 
clarified  that  United  States-person  identifiers  will  sot  be  used  to  query  the  fhiits  of  NSA’ s 
upstream  collection.  Aug.  30  Submission  at  11.  NSA’s  upstream  collection  acquires 
approximately  9%  of  the  total  Internet  communications  acquired  by  NSA  under  Section  702. 
Aug.  16  Submission  at  2. 
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querying  provision  found  at  Section  3(b)(5)  of  the  amended  NSA  minimization  procedures 

should  not  be  problematic  in  a  collection  that  is  focused  on  non-United  States  persons  located 
outside  the  United  States  and  that,  in  the  aggregate,  is  less  likely  to  result  in  the  acquisition  of 
nonpublic  information  regarding  non-consenting  United  States  persons. 

A  second  change  to  the  NSA  minimization  procedures  is  the  addition  of  language 
specifying  that  the  five-year  retention  period  for  communications  that  are  not  subject  to  earlier 
destruction  runs  from  the  expiration  date  of  the  certification  authorizing  the  collection.  Sge  NSA 
Minimization  Procedures,  §§  3(b)(1),  3(c),  5(3)(b),  and  6(a)(1)(b).  The  NSA  minimization 
procedures  that  were  previously  approved  by  the  Court  included  a  retention  period  of  five  years, 
but  those  procedures  do  not  specify  when  the  five-year  period  begins  to  run.  The  change 
proposed  here  harmonizes  the  procedures  with  the  corresponding  provision  of  the  FBI 
minimization  procedures  for  Section  702  that  has  already  been  approved  by  the  Court.  See  FBI 
Minimization  Procedures  at  3  (f  j). 

The  two  remaining  changes  to  the  NSA  minimization  procedures  ai’e  intended  to  clarify 
tlie  scope  of  the  existing  procedures.  The  government  has  added  language  to  Section  1  to  make 
explicit  that  the  procedures  apply  not  only  to  NSA  employees,  but  also  to  any  other  persons 
engaged  in  Section  702-related  activities  that  are  conducted  under  the  direction,  authority  or 
control  of  the  Director  of  NSA,  NSA  Minimization  Procedures  at  1 .  According  to  the 
government,  this  new  language  is  intended  to  clarify  that  Central  Security  Service  personnel 
conducting  signals  intelligence  operations  authorized  by  Section  702  are  bound  by  the 
procedures,  even  when  they  are  deployed  with  a  militaiy  unit  and  subject  to  the  military  chain  of 
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command,  The  second  clarifying  amendment  is  a  change  to  the  definition  of  “identification  of  a 

United  States  person”  in  Section  2.  The  new  language  eliminates  a  potential  ambiguity  that 
might  have  resulted  in  the  inappropriate  treatment  of  the  name,  unique  title,  or  address  of  a 
United  States  person  as  non-identifying  information  in  certain  circumstances.  Id  at  2.  These 
amendments,  which  resolve  any  arguable  ambiguity  in  favor  of  broader  application  of  the 
protections  found  in  the  procedures,  raise  no  concerns. 

3.  The.  Amended  CIA  Minimization  Procedures 

The  CIA  minimization  procedures  include  a  new  querying  provision  similar  to  the 
provision  that  the  government  proposes  to  add  to  theNSA  minimization  procedures  and  that  is 
discussed  above.  CIA  Minimization  Procedures  §  4.  The  new  language  would  allow  the  CIA  to 
conduct  queries  of  Section  702-acquired  information  using  United  States-person  identifiers.  All 
CIA  queries  of  the  Section  702  collection  would  be  subject  to  review  by  the  Department  of 
Justice  and  the  Office  of  the  DNT.  Sgs  id.  For  the  reasons  stated  above  with  respect  to  the 
relaxed  queryii^  provision  in  the  amended  NSA  minimization  procedures,  the  addition  of  the 
new  CIA  querying  provision  does  not  preclude  the  Court  foom  concluding  that  the  amended  CIA 
minimization  procedures  satisfy  the  statutory  definition  of  minimization  procedures  and  comply 
with  the  Fourtii  Amendment.^ 

The  amended  CIA  minimization  procedures  include  a  definition  of  “United  States  person 
identity,”  a  term  that  is  not  defined  in  the  current  version  of  the  procedures.  CIA  Minimization 

“  The  Court  understands  that  NSA  does  not  share  its  upstream  collection  in 
unminimized  form  with  the  CIA. 
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Procedures  §  1  .b.  The  proposed  definition  closely  tracks  the  revised  definition  of  “identification 

of  a  United  States  person”  that  is  included  in  the  amended  NS  A  minimization  procedures  and 
discussed  above.  For  the  same  reasons,  the  addition  of  this  definition,  which  clarifies  the  range 
of  protected  information,  raises  no  concerns  in  the  context  of  the  CIA  minimization  procedures. 

Another  new  provision  of  the  CIA  minimization  procedures  prescribes  the  manner  in 
which  the  CIA  must  store  unminimized  Section  702-acquired  communications.  See  CIA 
Minimization  Procedures  §  2.  The  same  provision  establishes  a  default  retention  period  for 
imrainimized  communications  that  do  not  qualify  for  longer  retention  irader  one  of  three  separate 
provisions.  Ses,  idt  Absent  an  extension  by  the  Director  of  the  National  Clandestine  Service  or 
one  of  his  superiors,  that  default  retention  period  is  five  years  firom  the  date  of  the  expiration  of 
the  certification  authorizing  the  collection.  Id.  As  noted  above,  tliis  is  the  same  default  retention 
period  that  appears  in  the  FBI  minimization  procedures  that  have  previously  been  approved  by 
the  Court.  See  FBI  Minhnization  Procedmes  at  3  (f  j). 

The  government  also  has  added  new  language  to  the  CIA  minimization  procedures  to 
clarify  that  United  States  person  information  deemed  to  qualify  for  retention  based  on  its  public 
availability  or  on  the  consent  of  the  person  to  whom  it  pertains  may  be  kept  indefinitely  and 
stored  separately  from  the  unminimized  information  subject  to  the  default  storage  and  retention 
rules  set  forth  in  new  Section  2,  which  is  discussed  above.  CIA  Minimization  Procedures  §  2. 
Because  FISA’s  minimization  requirements  are  limited  to  the  acquisition,  retention,  and 
dissemination  of“nonpubliclv  available  information  concerning  unconsentine  United  States 
persons,”  this  provision  raises  no  statutoiy  concern.  Sss  50  U.S.C,  §§  1801(h)(1),  182l(4)(A) 
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(emphasis  added).  It  likewise  raises  no  Fourth  Amendment  problem.  Sss  Katzv.  United  States. 

389  U.S,  347, 351  (1967)  (“What  a  person  knowingly  exposes  to  the  public  ...  is  not  a  subject  of 
Fourth  Amendment  protection.”). 

Finally,  a  new  provision  would  expressly  allow  the  CIA  to  retain  information  acquired 
pursuant  to  Section  702  in  emergency  backup  systems  that  may  be  used  to  restore  data  in  the 
event  of  a  system  failure.  CIA  Minimization  Procedures  §  6(e).  Only  non-analyst  technical 
personnel  will  have  access  to  data  stored  in  data  backup  systems.  Id,  Further,  in  the  event  that 
such  ^sterns  are  used  to  restore  lost,  destroyed,  or  inaccessible  data,  the  CIA  must  apply  its 
minimization  procedures  to  the  transferred  data,  hi  The  FBI  minimization  procedures  that  have 
previously  been  approved  by  the  Court  contemplate  the  storage  of  Section  702  collection  in 
emergency  backup  systems  that  are  not  accessible  to  analysts,  subject  to  similar  restrictions.  See 
FBI  Minimization  Procedures  at  2  (^  e.3).  The  Court  likewise  sees  no  problem  with  the  addition 
of  Section  6(e)  to  the  CIA  minimization  procedures. 

D.  The  Effect  of  the  Government’s  Disclosures  Regarding  NSA’s  Acquisition  of 
Internet  Transactions 

Based  on  the  government’s  prior  representations,  the  Court  has  previously  analyzed 
NSA’s  targeting  and  minimization  procedures  only  in  the  context  of  NS  A  acquiring  discrete 
communications.  Now,  however,  in  light  of  the  government’s  revelations  as  to  the  manner  in 
which  NSA  acquires  Internet  communications,  it  is  clear  that  NSA  acquires  “Internet 
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transactions,”^^  including  transactions  that  contain  a  single  discrete  communication  (“Single 

Communication  Transactions”  or  “SCTs”),  and  transactions  that  contain  multiple  discrete 
communications  (“Multi-[CIommunication  Transactions”  or  “MCTs”),  ^  Aug.  16  Submission 
at  1, 


The  Court  has  repeatedly  noted  that  the  government’s  targeting  and  minimization 
procedures  must  be  considered  in  light  of  the  communications  actually  acquired,  Docket  No. 
Illllllllllllllllllll^^  (“Substantial  implementation  problems  can, 

notwithstanding  the  government’s  intent,  speak  to  whetiier  the  applicable  targeting  procedures 
are  ‘reasonably  designed’  to  acquire  only  the  communications  of  non-U.S.  persons  outside  the 
United  States.”),  see  also  Docket  No.  ^^||||||||||||||^^|||||||||||||g|||g|||^^ 

Until  now,  the  Court  had  a  singular  understanding  of  the  nature  of  NSA’s  acquisitions  under 
Section  702.  Accordingly,  analysis  of  the  implementation  of  the  procedures  focused  on  whether 
NSA’s  procedures  were  applied  effectively  in  that  context  and  whether  the  procedures  adequately 
addressed  over-collections  that  occurred.  But,  for  the  first  time,  the  government  has  now  advised 
the  Court  that  the  volume  and  nature  of  the  information  it  has  been  collecting  is  fundamentally 
different  from  what  the  Court  had  been  led  to  believe.  Therefore,  the  Court  must,  as  a  matter  of 
first  impression,  consider  whether,  in  view  of  NSA’s  acquisition  of  Internet  transactions,  the 
targeting  and  minimization  procedures  satisfy  the  statutory  standards  and  comport  with  the 


The  government  describes  an  Internet  “transaction”  as  “a  complement  of  ‘packets’ 
traversing  the  Internet  that  together  may  be  understood  by  a  device  on  the  Internet  and,  where 
appiicable,  rendered  in  an  intelligible  form  to  the  user  of  that  device.”  June  1  Submission  at  1. 
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Fourth  Amendment. 

For  the  reasons  set  forth  below>  the  Court  finds  that  NSA’s  targeting  procedures,  as  the 
government  proposes  to  implement  them  in  connection  with  MCTs,  are  consistent  with  the 
reqvurements  of  50  U.S.C,  §  1 88  la(d)(l ),  However,  the  Court  is  unable  to  find  that  NSA’s 
minimization  procedures,  as  the  government  proposes  to  apply  them  in  connection  with  MCTs, 
are  “reasonably  designed  in  light  of  the  purpose  and  technique  of  the  particular  [surveillance  or 
physical  search],  to  minimize  the  acquisition  and  retention,  and  prohibit  the  dissemination,  of 
nonpublicly  available  information  concerning  unconsenting  United  States  persons  consistent 
with  the  need  of  the  United  States  to  obtain,  produce,  and  disseminate  foreign  intelligence 
information.”  50  U.S.C.  §§  1801(h)(1)  &1821(4)(A),  The  Court  is  also  unable  to  find  that 
NSA’s  targeting  and  minimization  procedures,  as  the  government  proposes  to  implement  them  in 
connection  with  MCTs,  are  consistent  with  the  Fourth  Amendment. 

1.  The  Scope  of  NSA*s  Upstream  Collection 

NSA  acquires  more  than  two  hundred  fifty  million  Internet  communications  each  year 
pursuant  to  Section  702,  but  the  vast  majority  of  these  communications  are  obtained  from 
Internet  service  providers  and  are  not  at  issue  here,^  Sept.  9  Submission  at  1;  Aug.  16 
Submission  at  Appendix  A.  Indeed,  NSA’s  upstream  collection  constitutes  only  approximately 

In  addition  to  its  upstream  collection,  NSA  acquires  discrete  Internet  communications 
from  Internet  service  providers  such 
lllllllllllll  Aug.  16  Submission  at  2;  Aug.  30  Submission  at  1 1 ; 
at  75-77.  NSA  refers  to  this  non-upstream  collection  as  its  “PRISM  collection.”  Aug.  30 
Submission  at  11.  The  Court  understands  that  NSA  does  not  acquire  “Internet  transactions” 
through  its  PRISM  collection,  Aug.  16  Submission  at  1 . 
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9%  of  the  total  Internet  communications  being  acquired  by  NS  A  under  Section  702.  Sept.  9 

Submission  at  1;  Aug.  16  Submission  at  2. 

Although  small  in  relative  terms,  NSA’s  upstream  collection  is  significant  for  three 
reasons.  First,  NSA’s  upstream  collection  is  “uniquely  capable  of  acquiring  certain  types  of 
targeted  communications  containing  valuable  foreign  intelligence  information.”^  Docket  No. 


Second,  the  Court  now  understands  that,  in  order  to  collect  those  targeted  Internet 
communications,  NSA’s  upstream  collection  devices  acquire  Internet  transactions,  and  NSA 
acquires  millions  of  such  transactions  each  year.^‘  Third,  the  government  has  acknowledged  that, 
due  to  the  technological  challenges  associated  with  acquiring  Internet  transactions,  NSA  is 
unable  to  exclude  certain  Internet  transactions  from  its  upstream  collectiorL  Seg  June  1 
Submission  at  3-12. 


In  its  June  1  Submission,  the  government  explained  that  NSA’s  upstream  collection 
devices  have  technological  limitations  that  significantly  affect  the  scope  of  collection,  m 


^  NSA  acquired  more  than  13.25  million  Internet  transactions  through  its  upstream 
collection  between  January  1 , 201 1,  and  June  30, 2011.  SSS  Aug.  16  Submission  at  2;  see  also 
Sept.  9  Submission  at  1-2. 
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Moreover,  at  the  time  of 

acquisition,  NSA’s  upstream  Internet  collection  devices  are  generally  incapable  of  distinguishing 
between  transactions  containing  only  a  single  discrete  communication  to,  from,  or  about  a  tasked 
selector  and  transactions  containing  multiple  discrete  communications,  not  all  of  which  may  be 
to,  from,  or  about  a  tasked  selector.*^  Idt  at  2, 

As  a  practical  matter,  this  means  that  NSA’s  upstream  collection  devices  acquire  any 
Internet  transaction  transiting  the  device  if  the  transaction  contains  a  targeted  selector  anywhere 
within  it,  and: 


See  id.  at  6. 

The  practical  implications  of  NSA’s  acquisition  of  Internet  transactions  thi'ough  its 
upstream  collection  for  the  Court’s  statutory  and  Fourth  Amendment  analyses  are  difficult  to 
assess.  The  sheer  volume  of  transactions  acquired  by  NS  A  through  its  upstream  collection  is 
such  that  any  meaningful  review  of  the  entire  body  of  the  transactions  is  not  feasible.  As  a  result, 
the  Court  .Cannot  know  for  certain  the  exact  number  of  wholly  domestic  communications 
acquired  through  this  collection,  nor  can  it  know  the  number  of  non-target  communications 
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acquired  or  the  extent  to  which  tihose  communications  are  to  or  from  United  States  persons  or 

persons  in  the  United  States.  Instead,  NSA  and  the  Court  can  only  look  at  samples  of  the  data 
and  then  draw  whatever  reasonable  conclusions  they  can  from  those  samples.  Even  if  the  Court 
accepts  the  validity  of  conclusions  derived  from  statistical  analyses,  there  are  significant  hurdles 
in  assessing  NSA’s  upstream  collection.  Internet  service  providers  are  constantly  changing  their 
protocols  and  the  services  they  provide,  and  often  give  users  the  ability  to  customize  how  they 
use  a  particular  service.^®  M.  at  24-25.  As  a  result,  it  is  impossible  to  define  with  any  specificity 
the  universe  of  transactions  that  will  be  acquired  by  NSA’s  upstream  collection  at  any  point  in 
the  future. 

Recognizing  that  further  revelations  concerning  what  NSA  has  actually  acquired  through 
its  702  collection,  together  with  the  constant  evolution  of  the  Internet,  may  alter  the  Court’s 
analysis  at  some  point  in  the  future,  the  Court  must,  nevertheless,  consider  whether  NSA’s 
targeting  and  minimization  procedures  are  consistent  with  FISA  and  the  Fourth  Amendment 
based  on  the  record  now  before  it.  In  view  of  the  revelations  about  how  NSA  is  actually 
conducting  its  upstream  collection,  two  fundamental  underpiimings  of  the  Court’s  prior 
assessments  no  longer  hold  true. 


TOP  SECRET//C0I»nNT//0RC0NJ>10F0BN - 

Page  32 


NSA-WIKI  00180 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  595  of  1298 


TOP  SECRET//eeMBST//ORee]N^NOP»RN- 
First,  the  Court  previously  imderstood  that  NSA’s  technical  measures^^  would  prevent  the 

acquisition  of  any  communication  as  to  which  the  sender  and  all  intended  recipients  were  located 
in  the  United  States  (“wholly  domestic  communication”)  except  for  “theoretically  possible”  cases 


acquiring,  and,  if  the  certifications  and  procedures  now  before  the  Court  are  approved,  will 
continue  to  acquire,  tens  of  thousands  of  wholly  domestic  communications.  NSA’s  manual 


review  of  a  statistically  representative  sample  drawn  from  its  upstream  collection^  reveals  that 
NSA  acquires  approximately  2,000-1 0,000  MCTs  each  year  that  contain  at  least  one  wholly 
domestic  communication.^'  Aug,  16  Submission  at  9.  In  addition  to  these  MCTs,  NSA 


“  In  an  effort  to  address  the  Court’s  concerns,  NSA  conducted  a  manual  review  of  a 
random  sample  consisting  of  50,440  Internet  transactions  taken  from  the  more  than  13.25  million 
Internet  transactions  acquired  through  NSA’s  upstream  collection  during  a  six  month  period.  See 
generally  Aug.  16  Submission  (describing  NSA’s  manual  review  and  the  conclusions  NSA  drew 
therefrom).  TOie  statistical  conclusions  reflected  in  this  Memorandum  Opinion  are  drawn  from 
NSA’s  analysis  of  that  random  sample. 

Of  the  approximately  1 3.25  million  Internet  transactions  acquired  by  NSA  through  its 
upstream  collection  durmg  the  six-month  period,  between  996  and  4,965  are  MCTs  that  contain  a 
wholly  domestic  communication  not  to,  from,  or  about  a  tasked  selector.  Aug.  16  Submission  at 
9. 
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likely  acquires  tens  of  thousands  more  wholly  domestic  communications  every  year,^^  given  that 

NSA’s  upstream  collection  devices  will  acquire  a  wholly  domestic  “about”  SCT  if  it  is  routed 
internationally.^^  Moreover,  the  actual  number  of  wholly  domestic  communications  acquired 


NSA’s  manual  review  focused  on  examining  the  MCTs  acquired  through  NSA’s 
upstream  collection  in  order  to  assess  whether  any  contmned  wholly  domestic  commtaucations. 
Sept.  7, 201 1  Hearing  Tr.  at  13-14.  Asa  result,  once  NSA  determined  that  a  transaction 
contained  a  single,  discrete  communication,  no  further  analysis  of  that  transaction  was  done.  See 
Aug.  16  Submission  at  3,  After  the  Court  expressed  concern  that  this  category  of  transactions 
might  also  contain  wholly  domestic  communications,  NSA  conducted  a  fiirther  review,  Sge 
Sept,  9  Submission  at  4.  NSA  ultimately  did  not  provide  the  Court  with  an  estimate  of  the 
number  of  wholly  domestic  “about”  SCTs  that  may  be  acquired  through  its  upstream  collection. 
Instead,  NSA  has  concluded  that  “the  probability  of  encountering  wholly  domestic 
communications  in  transactions  that  feature  only  a  single,  discrete  communication  should  be 
smaller  -  and  certainly  no  greater  -  than  potentially  encountering  wholly  domestic 
communications  within  MCTs.”  Sept,  13  Submission  at  2, 

The  Court  understands  this  to  mean  that  the  percentage  of  wholly  domestic 
communications  within  the  universe  of  SCTs  acquired  through  NSA’s  upstream  collection 
should  not  exceed  the  percentage  of  MCTs  containing  a  wholly  domestic  communication  that 
NSA  found  when  it  examined  all  of  the  MCTs  within  its  statistical  sample.  Since  NSA  found  10 
MCTs  with  wholly  domestic  communications  within  the  5,081  MCTs  reviewed,  the  relevant 
percentage  is  .197%  (10/5,081),  Aug.  16  Submission  at  5, 

NSA’s  manual  review  found  that  approximately  90%  of  the  50,440  transactions  in  the 
sample  were  SCTs.  Id.  at  3.  Ninety  percent  of  the  approximately  13.25  million  total  Internet 
transactions  acquired  by  NSA  throu^  its  upstream  collection  during  the  six-month  period,  works 
out  to  be  approximately  1 1,925,000  transactions.  Those  1 1,925,000  transactions  would 
constitute  the  universe  of  SCTs  acquired  during  the  six-month  period,  and  .197%  of  that  universe 
would  be  approximately  23,000  wholly  domestic  SCTs.  Thus,  NSA  may  be  acquiring  as  many 
as  46,000  wholly  domestic  “about”  SCTs  each  year,  in  addition  to  the  2,000-10,000  MCTs 
referenced  above. 

Internet  communications  are  “nearly  always  transmitted  from  a  sender  to  a  recipient 
through  multiple  legs  before  reaching  their  final  destination.”  June  1  Submission  at  6.  For 
examplejane-maUinessagesentfiom^ej^  user of^H^I 

^^^|||||||||[||||||||||||||||||H  least  travel  from  themjj^^^^r^ 

ow^mnputerno^^|^|||||[||||^^^o]|||||^||||^^  and  then  to  the  compute^fdif||H[H 
user.  Mi  Because  the  communication’s  route  is  made  up  of  multiple  legs,  the  transaction  used  to 
transmit  the  communication  across  any  particular  leg  of  the  route  need  only  identify  the  IP 

(continued...) 
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may  be  still  higher  in  view  of  NSA’s  inability  conclusively  to  determine  whether  a  significant 

portion  of  the  MCTs  within  its  sample  contained  wholly  domestic  communications.^^ 

Second,  the  Court  previously  understood  that  NSA’s  upstream  collection  would  only 
acquire  the  communication  of  a  United  States  person  or  a  person  in  the  United  States  if:  1)  that 


^^(...continued) 

addresses  at  either  end  of  that  leg  in  order  to  properly  route  the  communication.  Id  at  7.  As  a 
result,  for  each  leg  of  the  route,  the  transaction  header  will  only  contain  the  IP  addresses  at  either 
end  of  that  particular  lee.  Idl 


^  During  its  manual  review,  NSA  was  unable  to  determine  whether  224  of  the  5,08 1 
MCTs  reviewed  contained  any  wholly  domestic  communications,  because  the  transactions 
lacked  sufficient  information  for  NSA  to  determine  the  location  or  identity  of  the  “active  user" 
fl.e..  the  individual  using  the  electronic  communications  account/address/identifier  to  interact 
with  his/her  Internet  service  provider).  Aug.  16  Submission  at  7.  NSA  then  conducted  an 
intensive  review  of  all  available  information  for  each  of  these  MCTs,  including  examining  the 
contents  of  each  discrete  communication  contained  within  it,  but  was  still  unable  to  determine 
conclusively  whether  any  of  these  MCTs  contained  wholly  domestic  communications.  Sept.  9 
Submission  at  3.  NSA  asserts  that  “it  is  reasonable  to  presume  tliat  [tlie]  224  MCTs  do  not 
contain  wholly  domestic  conomunications,”  but  concedes  that,  due  to  the  limitations  of  the 
technical  means  used  to  prevent  the  acquisition  of  wholly  domestic  communications,  NSA  may 
acquire  wholly  domestic  communications.  Seg  Aug.  30  Submission  at  7-8.  Uie  Court  is 
prepared  to  accept  that  the  number  of  wholly  domestic  commumcations  acquired  in  this  category 
of  MCTs  is  relatively  small,  for  the  reasons  stated  in  the  government’s  August  30  Submission. 
However,  when  considering  NSA’s  upstream  collection  as  a  whole,  and  the  iimitetions  of  NSA’s 
technical  means,  the  Court  is  not  prepared  to  presume  that  the  number  of  wholly  domestic 
coraraunications  contained  within  this  category  of  communications  will  be  zero.  Accordingly, 
the  Court  concludes  that  this  category  of  communications  acquired  tlirough  NSA’s  upstream 
collection  may  drive  the  total  number  of  wholly  domestic  communications  acquired  slightly 
hi^er. 
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person  was  in  direct  contact  with  a  targeted  selector;  2)  the  communication  referenced  the 

targeted  selector,  and  the  communication  fell  into  one  of|^|  specific  categories  of  "about” 
communications;  or  3)  despite  the  operation  of  the  targeting  procedures,  United  States  persons  or 
persons  inside  the  United  States  were  mistakenly  targeted.  See  Docket  No.  ||||||||||||||||g||||||^||^ 

But  the  Court  now  understands  that,  in  addition  to  these 
communications,  NSA’s  upstream  collection  also  acquires;  a)  the  communications  of  United 
States  persons  and  persons  in  the  United  States  that  are  not  to,  ftom,  or  about  a  tasked  selector 
and  that  are  acquired  solely  because  the  communication  is  contained  within  an  MCT  that 
somewhere  references  a  tasked  selector^ 

imilllllllll^l  and  b)  any  Internet  transaction  that  references  a  targeted  selector,  regardless  of 
whether  the  transaction  falls  within  one  of  them  previously  identified  categories  of  “about 
communications,”  seg  June  1  Submission  at  24-27.  ^h||||||||||||||||||h 


On  the  current  record,  it  is  difficult  to  assess  how  many  MCTs  acquired  by  NSA  actually 
contain  a  communication  of  or  concerning  a  United  States  person,^*  or  a  communication  to  or 
from  a  person  in  the  United  States.  This  is  because  NSA’s  manual  review  of  its  upstream 
collection  focused  primarily  on  wholly  domestic  communications  -  ia,  if  one  party  to  the 


NSA’s  minimization  procedures  define  “[cjommunications  of  a  United  States  person” 
to  include  "all  communications  to  which  a  United  States  person  is  a  party.”  NSA  Minimization 
Procedures  §  2(c).  “Communications  concerning  a  United  States  person”  include  “all 
communications  in  which  a  United  States  person  is  discussed  or  mentioned,  except  where  such 
communications  reveal  only  publicly-available  information  about  the  person.  M,  §  2(b). 
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comnaunicatvon.  was  determined  to  be  outside  the  United  States,  the  communication  was  not 

further  analyzed.  Aug.  16  Submission  at  1-2.  Nevertheless,  NS  A’ s  manual  review  did  consider 
the  location  and  identity  of  the  active  user  for  each  MCT  acquired,  and  this  information  -  when 
considered  together  with  certain  presumptions  --  shows  that  NSA  is  likely  acquiring  tens  of 
thousands  of  discrete  communications  of  non-target  United  States  persons  and  persons  in  the 
United  States,  by  virtue  of  the  fact  that  their  communications  are  included  in  MCTs  selected  for 
acquisition  by  NSA’s  upstream  collection  devices.^* 

To  illustrate,  based  upon  NSA’s  analysis  of  the  location  and  identity  of  the  active  user  for 
the  MCTs  it  reviewed,  MCTs  can  be  divided  into  four  categories: 

1 .  MCTs  as  to  which  the  active  user  is  the  user  of  the  tasked  facility  (i.e..  the  target  of  the 
acquisition)  and  is  reasonably  believed  to  be  located  outside  the  United  States;^’ 

2.  MCTs  as  to  which  the  active  user  is  a  non-target  who  is  believed  to  be  located  inside 
the  United  States; 

3.  MCTs  as  to  which  the  active  user  is  a  non-target  who  is  believed  to  be  located  outside 
the  United  States;  and 


Although  there  is  ajme  overlap  between  this  category  of  communications  and  the  tens 
of  thousands  of  wholly  domestic  communications  discussed  above,  the  overlap  is  limited  to 
MCTs  containing  wholly  domestic  communications,  To  the  extent  that  the  wholly  domestic 
communications  acquired  are  SCTs,  they  are  excluded  &om  the  MCTs  referenced  here. 
Similarly,  to  the  extent  communications  of  non-target  United  States  persons  and  persons  in  the 
United  States  that  are  contained  within  the  tens  of  thousands  of  MCTs  referenced  here  are  not 
wholly  domestic,  they  would  not  be  included  in  the  wholly  domestic  communications  referenced 
above. 


”  Although  it  is  possible  for  an  active  user  target  to  be  located  in  the  United  States, 
NSA’s  targeting  procedures  require  NSA  to  terminate  collection  if  it  determines  that  a  target  has 
entered  the  United  States.  NSA  Targeting  Procedures  at  7-8.  Accordingly,  the  Court  excludes 
this  potential  category  from  its  analysis. 
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4.  MCTs  as  to  which  the  active  user’s  identity  or  location  cannot  be  determined. 

Aug.  16  Submission  at  4-8. 

With  regard  to  the  first  category,  if  the  target  is  the  active  user,  then  it  is  reasonable  to 
presume  that  all  of  the  discrete  communications  within  an  MCT  will  be  to  or  fiem  the  target. 
Although  United  States  persons  and  persons  in  the  United  States  may  be  party  to  any  of  those 
conununications,  NSA’s  acquisition  of  such  communications  is  of  less  concern  than  the 
communications  described  in  the  following  categories  because  the  communicants  were  in  direct 
communication  with  a  tasked  facility,  and  the  acquisition  presumptively  serves  the  foreign 
intelligence  purpose  of  the  collection.  NSA  acquires  roughly  300-400  thousand  such  MCTs  per 
year.^® 

For  the  second  category,  since  the  active  user  Is  a  non-target  who  is  located  inside  the 
United  States,  there  is  no  reason  to  believe  fiiat  all  of  the  discrete  communications  contained 
within  the  MCTs  will  be  to,  from,  or  about  the  targeted  selector  (although  there  would  need  to  be 
at  least  one  such  communication  in  order  for  NSA’s  upstream  devices  to  acquire  the  transaction). 
Further,  because  the  active  user  is  in  the  United  States,  the  Court  presumes  that  the  majority  of 
that  person’s  communications  will  be  with  other  persons  in  the  United  States,  many  of  whom 
will  be  United  States  persons.  NSA  acquires  approximately  7,000-8,000  such  MCTs  per  year, 
each  of  which  likely  contains  one  or  more  non-target  discrete  communications  to  or  from  other 


“  NSA  acquired  between  168,853  and  206,922  MCTs  as  to  which  the  active  user  was  the 
target  over  the  six-month  period  covered  by  the  sample.  Aug.  1 6  Submission  at  9. 
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persons  in  the  United  States.^’ 

The  third  category  is  similar  to  the  second  in  that  the  active  user  is  a  non-target. 
Therefore,  there  is  no  reason  to  believe  that  all  of  the  communications  within  the  MCTs  will  be 
to,  from,  or  about  the  targeted  selector  (although  there  would  need  to  be  at  least  one  such 
communication  in  order  for  NSA’s  upstream  devices  to  acquire  the  transaction).  However, 
because  the  active  user  is  believed  to  be  located  outside  the  United  States,  the  Court  presumes 
that  most  of  that  persons’s  communications  will  be  with  other  persons  who  are  outside  the 
United  States,  most  of  whom  will  be  non-United  States  persons.  That  said,  the  Court  notes  that 
some  of  these  MCTs  are  likely  to  contain  non-target  communications  of  or  concerning  United 
States  persons,  or  that  are  to  or  from  a  person  in  the  United  States.^®  The  Court  has  no  way  of 
knowing  precisely  how  many  such  communications  are  acquired.  Nevertheless,  it  appears  that 
NSA  acquires  at  least  1 .3  million  such  MCT s  each  year,''  ‘  so  even  if  only  1  %  of  these  MCTs 


In  its  manual  review,  NSA  identified  ten  MCTs  as  to  which  the  active  user  was  in  the 
United  States  and  that  contained  at  least  one  wholly  domestic  communication.  See  Aug.  16 
Submission  at  5-7.  NSA  also  identified  seven  additional  MCTs  as  to  which  the  active  user  was 
in  the  United  Stales.  at  5.  Although  NSA  determined  that  at  least  one  parly  to  each  of  the 
communications  within  the  seven  MCTs  was  reasonably  believed  to  be  located  outside  the 
United  States,  NSA  did  not  indicate  whether  any  of  the  communicants  were  United  States 
persons  or  persons  in  the  United  States,  idi  The  Court  sees  no  reason  to  treat  these  two 
categories  of  MCTs  di^rently  because  the  active  users  for  both  were  in  the  United  States. 
Seventeen  MCTs  constitutes  .3%  of  the  MCTs  reviewed  (5,081),  and  .3%  of  the  1.29-1.39 
million  MCTs  NSA  acquires  every  six  months  (g^id,  at  8)  is  3,870-  4,170,  or  7,740-8,340  every 
year. 


'The  government  has  acknowledged  as  much  in  its  submissions,  Sss  June  28 
Submission  at  5. 

Based  on  its  manual  review,  NSA  assessed  that  2668  of  the  5,081  MCTs  reviewed 

(continued,..) 
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contain  a  single  non-target  communication  of  or  concerning  a  United  States  person,  or  that  is  to 
or  from  a  person  in  the  United  States,  NSA  would  be  acquiring  in  excess  of  10,000  additional 
discrete  conununications  each  year  that  are  of  or  concerning  United  States  persons,  or  that  are  to 
or  from  a  person  in  the  United  States. 

The  fourth  category  is  the  most  problematic,  because  vdthout  the  identity  of  the  active 
user  -  i.e..  whether  the  user  is  the  target  or  a  non-tai'get  -  or  the  active  user’s  location,  it  is 
difficult  to  determine  what  presumptions  to  make  about  these  MCTs.  NSA  acquires 
approximately  97,000-140,000  such  MCTs  each  year.'*^  In  tlie  context  of  wholly  domestic 
communications,  the  government  urges  the  Court  to  apply  a  series  of  presumptions  that  lead  to 
the  conclusion  that  this  category  would  not  contain  any  wholly  domestic  communications.  Aug. 
30  Submission  at  4-8.  The  Court  questions  the  validity  of  those  presumptions,  as  applied  to 
wholly  domestic  communications,  but  certainly  is  not  inclined  to  apply  them  to  assessing  the 
likelihood  tliat  MCTs  might  contain  communications  of  or  concerning  United  States  persons,  or 
communications  to  or  from  persons  in  the  United  States.  The  active  users  for  some  of  these 


^‘(...continued) 

(approximately  52%)  had  a  non-target  active  user  who  was  reasonably  believed  to  be  located 
outside  the  United  States.  Aug.  16  Submission  at  4-5.  Fifty-two  percent  of  the  1 ,29  to  1.39 
million  MCTs  that  NSA  assessed  were  acquired  through  its  upstream  collection  every  six  months 
would  work  out  to  670,800  -  722,800  MCTs,  or  approximately  1 .3-1 .4  million  MCTs  per  year 
that  have  a  non-target  active  user  believed  to  be  located  outside  the  United  States. 


NSA  determined  that  224  MCTs  of  the  5,08 1  MCTs  acquired  during  a  six-month 


_ From  this,  NSA  concluded  that  it  acquired  between  48,609 

and  70,1 68  such  MCTs  every  six  months  through  its  upstream  collection  (or  approximately 
97,000-140,000  such  MCTs  each  year).  J4.  at  9  n.27. 


TOP  SECRET//COMlNT//ORCON,NQFORN 


Page  40 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  603  of  1298 


TOP  SECRET//COMINT//ORCON,NeFORN 
MCTs  may  be  located  in  the  United  States,  and,  even  if  the  active  user  is  located  overseas,  the 

MCTs  may  contain  non-target  communications  of  or  concerning  United  States  persons  or  tliat  are 
to  or  from  persons  in  the  United  States.  Accordingly,  this  “unknown”  category  likely  adds 
substantially  to  the  number  of  non-target  communications  of  or  concerning  United  States  persons 
or  that  are  to  or  from  persons  in  the  United  States  being  acquired  by  NS  A  each  year. 

In  sum,  then,  NSA’s  upstream  collection  is  a  small,  but  unique  part  of  the  government’s 
overall  collection  under  Section  702  of  the  FAA.  NSA  acquires  valuable  information  through  its 
upstream  collection,  but  not  without  substantial  intrusions  on  Fourth  Amendment-protected 
interests.  Indeed,  the  record  before  this  Court  establishes  that  NSA’s  acquisition  of  Internet 
transactions  likely  results  in  NSA  acquiring  annually  tens  of  thousands  of  wholly  domestic 
communications,  and  tens  of  thousands  of  non-target  communications  of  persons  who  have  little 
or  no  relationship  to  the  target  but  who  are  protected  under  the  Fourth  Amendment  Both 
acquisitions  raise  questions  as  to  whether  NSA’s  targeting  and  minimization  procedures  comport 
with  FISA  and  the  Fourth  Amendment, 

2.  NSA’s  Targeting  Proceduies 

The  Court  will  first  consider  whether  NSA’s  acquisition  of  Internet  transactions  through 
its  upstream  collection,  as  described  above,  means  that  NSA’s  targeting  procedures,  as 
implemented,  are  not  "reasonably  designed”  to:  1)  “ensure  that  any  acquisition  authorized  under 
[the  certifications]  is  limited  to  targeting  persons  reasonably  believed  to  be  located  outside  the 
United  States”;  and  2)  “prevent  the  intentional  acquisition  of  any  communication  as  to  which  the 
sender  and  all  intended  recipients  known  at  the  time  of  the  acquisition  to  be  located  in  the 
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Umted  States,”  50  U.S.C,  §  1881a(d)(l);  Mi  §  (i)(2)(B),  The  Court  concludes  that  the  manner  in 
which  NS  A  is  currently  implementing  the  targeting  procedures  does  not  prevent  the  Court  jfrom 
making  the  necessary  findings,  and  hence  NS A’s  targeting  procedures  do  not  offend  FISA. 

a.  Targeting  Persons  Reasonably  Believed  to  be  Located 
Outside  the  United  States 

To  the  extent  NSA  is  acquiring  Internet  transactions  that  contain  a  single  discrete 
communication  that  is  to,  from,  or  about  a  tasked  selector,  the  Court’s  previous  analysis  remains 
valid.  As  explained  in  greater  detail  in  the  Court’s  September  4, 2008  Memorandum  Opinion,  in 
this  setting  the  person  being  targeted  is  the  user  of  the  tasked  selector,  and  NSA’s  pre-targeting 
and  post-targeting  procedures  ensure  that  NSA  will  only  acquire  such  transactions  so  long  as 
there  is  a  reasonable  belief  that  the  target  is  located  outside  the  United  States,  Docket  No. 


But  NSA’s  acquisition  of  MCTs  complicates  the  Court’s  analysis  somewhat.  With  regard 
to  “about”  communications,  the  Court  previously  found  that  the  user  of  the  tasked  facility  was 
the  “target”  of  the  acquisition,  because  the  government’s  purpose  in  acquiring  such 
communications  is  to  obtain  information  about  that  user.  See  isL  at  1 8.  Moreover,  the 
communication  is  not  acquired  because  the  government  has  any  interest  in  the  parties  to  the 
communication,  other  than  their  potential  relationship  to  the  user  of  the  tasked  facility,  and  the 
parties  to  an  “about”  communication  do  not  become  targets  unless  and  until  they  are  separately 
vetted  under  the  targeting  procedures,  See  M,  at  1 8-19. 

In  the  case  of  “about"  MCTs  -  ie„  MCTs  that  are  acquired  because  a  targeted  selector  is 
referenced  somewhere  in  the  tiansaction  -  NSA  acquires  not  only  the  discrete  communication 
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that  references  the  tasked  selector,  but  also  in  many  cases  the  contents  of  other  discrete 

communications  that  do  not  reference  the  tasked  selector  and  to  which  no  target  is  a  party.  Sgc 
May  2  Letter  at  2-3  ^3^  acquiring  such  MCTs,  NSA  likely 

acquires  tens  of  thousands  of  additional  communications  of  non-targets  each  year,  many  of 
whom  have  no  relationship  whatsoever  with  the  user  of  the  tasked  selector.  While  the  Court  has 
concerns  about  NSA’s  acquisition  of  these  non-target  communications,  the  Court  accepts  the 
government’s  representation  that  the  “sole  reason  [a  non-target’s  MCT]  is  selected  for 
acquisition  is  that  it  contains  the  presence  of  a  tasked  selector  used  by  a  person  who  has  been 
subjected  to  NSA’s  targeting  procedures.”  June  I  Submission  at  4.  Moreover,  at  the  time  of 
acquisition,  NSA’s  upstream  collection  devices  often  lack  the  capability  to  determine  whether  a 
transaction  contains  a  single  communication  or  multiple  communications,  or  to  identity  the 
parties  to  any  particular  communication  within  a  transaction.  See  id  Therefore,  the  Court  has 
no  reason  to  believe  that  NSA,  by  acquiring  Internet  transactions  containing  multiple 
communications,  is  targeting  anyone  other  than  the  user  of  the  tasked  selector.  Seg  United  States 
v.  Chemical  Found..  Inc..  272  U.S.  1 , 14-1 5  (1 926)  (“The  presumption  of  regularity  supports  the 
official  acts  of  public  officers,  and,  in  the  absence  of  clear  evidence  to  the  contrary,  courts 
presume  that  they  have  properly  discharged  their  official  duties.”). 

b.  Acquisition  of  Wholly  Domestic  Communications 

NSA’s  acquisition  of  Internet  transactions  complicates  the  analysis  required  by  Section 
1881a(d)(l)CB),  since  the  record  shows  that  the  government  knowingly  acquires  tens  of 
thousands  of  wholly  domestic  communications  each  year.  At  first  blush,  it  might  seem  obvious 
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that  targeting  procedures  that  permit  such  acquisitions  could  not  be  “reasonably  designed ...  to 

prevent  the  intentional  acquisition  of  any  communication  as  to  which  the  sender  and  all  intended 
recipients  are  known  at  the  time  of  the  acquisition  to  be  located  in  the  United  States.”  50  U.S.C. 

§  1881a(d)(l  )(B).  However,  a  closer  examination  of  the  language  of  the  statute  leads  the  Court 
to  a  different  conclusion. 

The  government  focuses  primarily  on  the  “intentional  acquisition”  language  in  Section 
1881a(d)(l)(B).  Specifically,  the  government  argues  thatNSA  is  not  “intentionally”  acquiring 
wholly  domestic  communications  because  the  government  does  not  intend  to  acquire  transactions 
containing  communications  that  are  wholly  domestic  and  has  implemented  technical  means  to 
prevent  the  acquisition  of  such  transactions.  Sss  June  28  Submission  at  12.  This  argument  fails 
for  several  reasons. 

NSA  targets  a  person  under  Section  702  certifications  by  acquiring  communications  to, 
from,  or  about  a  selector  used  by  that  person.  Therefore,  to  the  extent  NSA’s  upstream  collection 
devices  acquire  an  Internet  transaction  containing  a  single,  discrete  communication  that  is  to, 
from,  or  about  a  tasked  selector,  it  can  hardly  be  said  that  NSA’s  acquisition  is  “unintentional.” 

In  fact,  the  government  has  argued,  and  the  Court  has  accepted,  that  the  government  intentionally 
acquires  communications  to  and  from  a  target,  even  when  NSA  reasonably  -  albeit  mistakenly  - 
believes  that  the  target  is  located  outside  the  United  States,  gee  Docket  No.  ||||||m||||||^B 


With  respect  to  MCTs,  the  sole  reason  NSA  acquires  such  transactions  is  the  presence  of 
a  tasked  selector  within  the  transaction.  Because  it  is  technologically  infeasible  for  NSA’s 
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upstream  collection  devices  to  acquire  only  the  discrete  communication  to,  from,  or  about  a 

tasked  selector  that  may  be  contained  within  an  MCT,  however,  the  govermnent  argues  that  the 
only  way  to  obtain  the  foreign  intelligence  information  found  within  the  discrete  communication 
is  to  acquire  the  entire  transaction  in  which  it  is  contained.  June  1  Submission  at  21.  Asa  result, 
the  govermnent  intentionally  acquires  all  discrete  communications  within  an  MCT,  including 
those  that  are  not  to,  from  or  about  a  tasked  selector.  Sss  June  28  Submission  at  12, 14;  see  also 
Sept  7, 201 1  Hearing  Tr.  at  33 ’34, 

The  fact  that  NSA’s  technical  measures  cannot  prevent  NSA  from  acquiring  transactions 
containing  wholly  domestic  communications  under  certain  circumstances  does  not  render  NSA’s 
acquisition  of  those  transactions  “unintentional.”  The  government  repeatedly  characterizes  such 
acquisitions  as  a  “failure”  of  NSA’s  “technical  means.”  June  28  Submission  at  12;  see  also  Sept. 
7, 201 1  Hearing  Tx.  at  35-3d.  However,  there  is  nothing  in  the  record  to  suggest  that  NSA’s 
technical  means  are  malfunctioning  or  otherwise  failing  to  operate  as  designed.  Indeed,  the 
government  readily  concedes  that  NSA  will  acquire  a  wholly  domestic  “about”  communication  if 
the  transaction  containing  the  communication  is  routed  through  an  international  hiternet  link 
being  monitored  by  NSA  or  is  routed  througli  a  foreign  server.  Sss  June  1  Submission  at  29. 

And  in  the  case  of  MCTs  containing  wholly  domestic  communications  that  are  not  to,  from,  or 
about  a  tasked  selector,  NSA  has  no  way  to  determine,  at  the  time  of  acquisition,  that  a  particular 
commtinication  within  an  MCT  is  wholly  domestic.  Ss£  id.  Furthermore,  now  that  NSA’s 
manual  review  of  a  sample  of  its  upsti'eam  collection  has  confirmed  that  NSA  likely  acquires 
tens  of  thousands  of  wholly  domestic  communications  each  year,  there  is  no  question  that  the 
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government  is  knowingly  acquiring  Internet  transactions  that  contain  wholly  domestic 

communications  through  its  upstream  collection.” 

The  government  argues  that  an  NSA  analyst’s  post-acquisition  discovery  that  a  particular 
Internet  transaction  contains  a  wholly  domestic  communication  should  retroactively  render 
NSA’s  acquisition  of  that  transaction  “unintentional.”  June  28  Submission  at  12.  That  argument 
is  unavailing.  NSA’s  collection  devices  are  set  to  acquire  transactions  that  contain  a  reference  to 
the  targeted  selector.  When  the  collection  device  acquires  such  a  transaction,  it  is  functioning 
precisely  as  it  is  intended,  even  when  the  transaction  includes  a  wholly  domestic  communication. 
The  language  of  the  statute  makes  clear  that  it  is  the  government’s  intention  at  the  time  of 
acquisition  that  matters,  and  the  government  conceded  as  much  at  the  hearing  in  this  matter. 

Sept.  7, 201 1  Hearing  Tr.  at  37-38. 

Accordingly,  the  Court  finds  that  NSA  intentionally  acquires  Internet  transactions  that 
reference  a  tasked  selector  through  its  upstream  collection  with  the  knowledge  that  there  are  tens 
of  thousands  of  wholly  domestic  communications  contained  within  those  transactions.  But  this 
is  not  the  end  of  the  analysis.  To  return  to  tiie  language  of  the  statute,  NSA’s  targeting 
procedures  must  be  reasonably  designed  to  prevent  the  intentional  acquisition  of“anv 
communication  as  to  which  the  sender  and  all  intended  j^cipients  are  known  at  the  time  of 


”  It  is  generally  settled  that  a  person  intends  to  produce  a  consequence  either  (a)  when  he 
acts  with  a  purpose  of  producing  that  consequence  or  (b)  when  he  acts  knovydng  that  the 
consequence  is  substantially  certain  to  occur.  Restatement  (Third)  of  Torts  §  1  (2010);  see  also 
United  States  v.  Dyer.  589  F.3d  520,  528  {1st  Cir.  2009)  (in  criminal  law,  “‘intent’  ordinarily 
requires  only  that  the  defendant  reasonably  knew  the  proscribed  result  would  occur”),  cert, 
denied.  130  S.  Ct  2422  (2010). 
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acquisitioit  to  be  located  in  the  United  States  ”  50  U.S.C.  §  1 881a(d)(l)(B)  (emphasis  added). 

The  underscored  language  requires  an  acquisition-by-acquisition  inquiry.  Thus,  the  Court  must 
consider  whether,  at  the  time  NSA  Intentionally  acquires  a  transaction  through  its  upstream 
collection,  NSA  vwll  know  that  the  sender  and  all  intended  recipients  of  any  particular 
communication  within  that  transaction  are  located  in  the  United  States. 

Presently,  it  is  not  technically  possible  for  NSA  to  configure  its  upstream  collection 


effect  of  this  technological  limitation  is  that  NSA  cannot  know  at  the  time  it  acquires  an  Internet 
transaction  whether  the  sender  and  ail  intended  recipients  of  any  particular  discrete 
communication  contained  within  the  transaction  are  located  inside  the  United  States. 


See  supra,  note  33. 
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Given  that  NSA’s  upstream  collection  devices  lack  the  capacity  to  detect  v/holly  domestic 
communications  at  the  time  an  Internet  transaction  is  acquired,  the  Court  is  inexorably  led  to  the 
conclusion  that  the  targeting  procedures  are  “reasonably  designed”  to  prevent  the  intentional 
acquisition  of  any  ccunmunication  as  to  which  the  sender  and  all  intended  recipients  are  known  at 
the  time  of  the  acquisition  to  be  located  in  the  United  States.  This  is  true  despite  the  fact  that 
NSA  knows  with  certainty  that  the  upstream  collection,  viewed  as  a  whole,  results  in  the 
acquisition  of  wholly  domestic  communications. 

By  expanding  its  Section  702  acquisitions  to  include  the  acquisition  of  Internet 
transactions  through  its  upstream  collection,  NSA  has,  as  a  practical  matter,  circumvented  the 
spirit  of  Section  1 881a(b)(4)  and  (d)(1)  with  regard  to  that  collection.  NSA’s  knowing 
acquisition  of  tens  of  thousands  of  wholly  domestic  conununications  through  its  upstream 
collection  is  a  cause  of  concern  for  the  Court.  But  the  meaning  of  the  relevant  statutory  provision 
is  clear  and  application  to  the  facts  before  the  Court  does  not  lead  to  an  impossible  or  absurd 
result  The  Court’s  review  does  not  end  with  the  targeting  procedures,  however.  The  Court  must 
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also  consider  whether  NSA’s  minimization  procedures  are  consistent  with  §1881a(e)(I)  and 

whether  NSA’s  targeting  and  minimization  procedures  are  consistent  with  the  requirements  of 
the  Fourth  Amendment. 

3.  NSA’s  Minimization  Procedures.  As  Applied  to  MCTs  in  tlie  Manner 
Proposed  bv  the  fiovemment.  Do  Not  Meet  FISA’s  Definition  of 
“Minimization  Procedures” 

The  Court  next  considera  whether  NSA’s  minimization  procedures,  as  the  government 
proposes  to  apply  them  to  Internet  transactions,  meet  the  statutory  requirements.  As  noted  above, 
50  U.S.C.  §  1 881a(e)(l)  requires  that  the  minimization  procedures  “meet  the  definition  of 

minimization  procedures  undo-  [50  U.S.C,  §§]  1801(h)  or  1821(4) - ”  That  definition  requires 

“specific  procedures,  which  shall  be  adopted  by  the  Attorney  General,  that  are  reasonably 
designed  in  light  of  the  purpose  and  technique  of  the  particular  [surveillance  or  physical  search], 
to  minimize  the  acquisition  and  retention,  and  prohibit  the  dissemination,  of  nonpublicly 
available  information  concerning  unconsenting  United  States  persons  consistent  with  the  need  of 
the  United  States  to  obtain,  produce,  and  disseminate  foreign  intelligence  information.”  50 
U.S.C,  §§  1801(h)(1)  &  1821(4)(A).  For  the  reasons  stated  below,  the  Court  concludes  that 
NSA’s  minimization  procedures,  as  applied  to  MCTs  in  the  manner  proposed  by  the  government, 
do  not  meet  the  .statutory  definition  in  all  respects. 

a.  The  Minimization  Framework 

NSA’s  minimization  procedures  do  not  expressly  contemplate  the  acquisition  of  MCTs, 
and  the  language  of  the  procedures  does  not  lend  itself  to  straightforward  application  to  MCTs. 
Most  notably,  various  provisions  of  the  NSA  minimization  procedures  employ  the  term 
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“commimication”  as  an  operative  term.  As  explained  below,  for  instance,  the  rules  governing 

retention,  handling,  and  dissemination  vary  depending  whether  or  not  a  communication  is 
deemed  to  constitute  a  “domestic  communication”  instead  of  a  “foreign  communication,” 

NS  A  Minimization  Procedures  §§  2(e),  5, 6, 7;  a  communication  “of’  or  “concerning”  a  U.S. 
person,  sge  jd  §§  2(b)-(c),  3(b)(lK2),  3(c);  a  “communication  to,  from,  or  about  a  target,” 

§  3(b)(4);  or  a  “communication . , .  reasonably  believed  to  contain  foreign  intelligence 
information  or  evidence  of  a  crime,”  But  MCTs  can  be  fairly  described  as  communications 

that  contain  several  smaller  communications.  Applying  the  terms  of  the  NSA  minimization 
procedures  to  MCTs  rather  than  discrete  communications  can  produce  very  different  results. 

In  a  recent  submission,  the  government  explained  how  NSA  proposes  to  apply  its 
minimization  procedures  to  MCTs,  §eg  Aug.  30  Submission  at  8-1 1  Before  discussing  the 
measures  proposed  by  the  government  for  handling  MCTs,  it  is  helpful  to  begin  with  a  brief 
overview  of  the  NSA  minimization  procedures  themselves.  The  procedures  require  that  all 
acquisitions  “will  be  conducted  in  a  manner  designed,  to  the  greatest  extent  feasible,  to  minimize 
the  acquisition  of  information  not  relevant  to  the  authorized  purpose  of  the  collection,”  NSA 


Although  NSA  has  been  collecting  MCTs  since  before  the  Court’s  approval  of  the  first 
Section  702  certification  in  2008,  sge  June  1  Submission  at  2,  it  has  not,  to  date,  applied  the 
measures  proposed  here  to  the  fiuits  of  its  upstream  collection.  Indeed,  until  NSA’s  manual 
review  of  a  six-month  sample  of  its  upstream  collection  revealed  the  acquisition  of  wholly 
domestic  communications,  the  government  asserted  that  NSA  had  never  found  a  wholly  domestic 
communication  in  its  upstream  collection.  See  id. 
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Minimization  Procedures  §  3(a)/*  Following  acquisition,  the  procedures  require  that,  “[a]s  a 
communication  is  reviewed,  NSA  analyst(s)  will  determine  whether  it  is  a  domestic  or  foreign 
communication  to,  from,  or  about  a  target  and  is  reasonably  believed  to  contain  foreign 
intelligence  information  or  evidence  of  a  crime,”  §  3(b)(4).  "Foreign  communication  means 

a  communication  that  has  at  least  one  communicant  outside  of  the  United  States.”  §  2(e). 

“All  other  communications,  including  communications  in  which  the  sender  and  all  intended 
recipients  are  reasonably  believed  to  be  located  in  the  United  States  at  the  time  of  acquisition,  are 
domestic  communications.”  Id,  In  addition,  domestic  communications  include  “[a]ny 
communications  acquired  through  the  targeting  of  a  person  who  at  the  time  of  targeting  was 
reasonably  believed  to  be  located  outside  the  United  States  but  is  in  fact  located  inside  the  United 
States  at  the  time  such  communications  were  acquired,  and  any  communications  acquired  by 
targeting  a  person  who  at  tlie  time  of  the  targeting  was  believed  to  be  a  non-United  States  person 

but  was  in  fact  a  United  States  person _ ”  Id,  §  3(d)(2).  A  domestic  communication  must  be 

“promptly  destroyed  upon  recognition  unless  the  Director  (or  Acting  Director)  of  NSA 
specifically  determines,  in  writing,  thaf  ’  the  communication  contains  foreign  intelligence 


Of  course,  NSA’s  separate  targeting  procedures,  discussed  above,  also  govern  tlie 
manner  in  which  communications  are  acquired. 
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information  or  evidence  of  a  crime*  or  that  it  Mis  into  another  narrow  exception  permitting 
retention.  See  id.  §  5.^’ 

Upon  detennining  that  a  communication  is  a  “foreign  communication,”  NSA  must  decide 
whether  the  communication  is  “of”  or  "concerning”  a  United  States  person.  Id.  S  6. 
“Communications  of  a  United  States  person  include  all  communications  to  which  a  United  States 
person  is  a  party.”  R  §  2(c).  “Communications  concerning  a  United  States  person  include  all 
communications  in  which  a  United  States  person  is  discussed  or  mentioned,  except  where  such 
communications  reveal  only  publicly-available  information  about  the  person,”  Id,  §  2(b). 

A  foreign  communication  that  is  of  or  concerning  a  United  States  person  and  that  is 
determined  to  contain  neither  foreign  intelligence  information  nor  evidence  of  a  crime  must  be 
destroyed  “at  the  earliest  practicable  point  in  the  processing  cycle,”  and  “may  be  retained  no 
longer  than  five  years  from  the  expiration  date  of  the  certification  in  any  event.”  §  3(b)(1).'’* 


Once  such  a  determination  is  made  by  the  Director,  the  domestic  commumcations  at 
issue  are  effectively  treated  as  “foreign  communications”  for  purposes  of  the  rules  regarding 
retention  and  dissemination. 

Although  Section  3(b)(1)  by  its  terms  applies  only  to  "inadvertently  acquired 
communications  of  or  concerning  a  United  States  person,”  the  government  has  informed  the 
Court  that  this  provision  is  intended  to  apply,  and  in  practice  is  applied,  to  all  foreign 
communications  of  or  concerning  United  States  persons  that  contain  neither  foreign  intelligence 
information  nor  evidence  of  a  ciime,  Docket  No.  702(i)-08-01,  Sept.  2, 2008  Notice  of 
Clarification  and  Correction  at  3-5.  Moreover,  Section  3(c)  of  the  procedures  separately  provides 
that  foreign  communications  that  do  not  qualify  for  retention  and  that  “are  known  to  contain 
communications  of  or  concerning  United  States  persons  will  be  destroyed  upon  recognition,” 
and,  like  unreviewed  communications,  “may  be  retained  no  longer  than  five  years  from  the 
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A.  foreign  communication  that  is  of  or  concerning  a  United  States  person  may  be  retained 
indefinitely  if  the  "dissemination  of  such  communications  with  reference  to  such  United  States 
persons  would  be  permitted”  under  the  dissemination  provisions  that  are  discussed  below,  or  if  it 
contains  evidence  of  a  crime.  Idi  §  6(a)(2)-(3).  If  the  retention  of  a  foreign  communication  of  or 
concerning  a  United  States  person  is  “necessary  for  the  maintenance  of  technical  databases,”  it 
may  be  retained  for  five  years  to  allow  for  technical  exploitation,  or  for  longer  tlian  five  years  if 
more  time  is  required  for  decryption  or  if  theNSA  Signals  Intelligence  Director  "determines  in 
writing  that  retention  for  a  longer  period  is  required  to  respond  to  authorized  foreign  intelligence 
or  counterintelligence  requirements.”  Mi  §  6(a)(1). 

As  a  general  rule,  “[a]  report  based  on  communications  of  or  concerning  a  United  Slates 
person  may  be  disseminated”  only  "if  the  identity  of  the  United  States  person  is  deleted  and  a 
generic  term  or  symbol  is  substituted  so  that  the  information  cannot  reasonably  be  connected 
with  an  identifiable  United  States  person.”  Mi  §  6(b).  A  report  including  the  identity  of  the 
United  States  person  may  be  provided  to  a  “recipient  requiring  the  identity  of  such  person  for  the 
performance  of  official  duties,”  but  only  if  at  least  one  of  eight  requirements  is  also  met  -  for 
instance,  if  “the  identity  of  the  United  States  person  is  necessary  to  understand  foreign 
intelligence  information  or  assess  its  importance,”  or  if  “information  indicates  (he  United  States 


‘**(...contmued) 

expiration  date  of  the  certification  authorizing  the  collection  in  any  event.” 
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person  may  be ...  an  agent  of  a  foreign  power”  or  that  he  is  "engaging  in  international  terrorian 
activities.”  Id.** 

b.  Proposed  Minimization  Measures  for  MCTs 

The  government  proposes  that  NSA’s  minimization  procedures  be  applied  to  MCTs  in 
the  following  manner.  After  acquisition,  upstream  acquisitions,  including  MCTs,  will  reside  in 
NS  A  repositories  until  they  are  accessed  (e.g..  in  response  to  a  query)  by  an  NS  A  analyst 
performing  his  or  her  day-to-day  work.  NSA  proposes  adding  a  “cautionary  baimer”  to  the  tools 
its  analysts  use  to  view  the  content  of  communications  acquired  through  upstream  collection 
under  Section  702.  Sa  Aug.  30  Submission  at  9.  The  banner,  which  will  be  “broadly  displayed 
on  [such]  tools,”  will  “direct  analysts  to  consult  guidance  on  how  to  identify  MCTs  and  how  to 
handle  them.”  14  at  9  &  n.b.*®  Analysts  will  be  trained  to  identify  MCTs  and  to  recognize 
wholly  domestic  communications  contained  within  MCTs.  Seg  14  at  8-9. 

When  an  analyst  identifies  an  upstream  acquisition  as  an  MCT,  the  analyst  will  decide 
whether  or  not  he  or  she  “seek[s]  to  use  a  discrete  communication  within  [the]  MCT,” 


**  The  procedures  also  permit  NSA  to  provide  unminimized  communications  to  the  CIA 
and  FBI  (subject  to  their  own  minimization  procedures),  and  to  foreign  governments  for  the 
limited  purpose  of  obtaining  “technical  and  linguistic  assistance.”  NSA  Minimization 
Procedures  §§  6(c),  8(b).  Neither  of  these  provisions  has  been  used  to  share  upstream 
acquisitions.  Sept.  7, 201 1  Hearing  Tr.  at  61-62. 

“  The  banner  will  not  be  displayed  for  communications  that  “can  be  first  identified 
through  technical  means  where  the  active  user  is  NSA’s  tasked  selector  or  that  contain  only  a 
single,  discrete  communication  based  on  particular  stable  and  well-known  protocols.”  Aug.  30 
Submission  at  9  n.6.  Sgg  infra,  note  27,  and  supra,  note  54. 
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presumably  by  reviewing  some  or  all  of  the  MCT’s  contents.  |d.  at  8.*'  “NSA  analysts  seeking 
to  use  a  discrete  communication  contained  in  an  MCT  (for  example,  in  a  FISA  application, 
intelligence  report,  or  Section  702  targeting)  will  assess  whether  the  discrete  communication  is 
to,  ftom,  or  about  a  tasked  selector.”  The  following  framework  will  then  be  applied: 

•  If  the  discrete  communication  that  the  analyst  seeks  to  use  is  to,  from,  or  about  a  tasked 
selector,  “any  U.S.  person  information  in  that  communication  will  be  handled  in 
accordance  with  the  NSA  minimization  procedures.”  Mi  Presumably,  this  means  that  the 
discrete  communication  will  be  treated  as  a  “foreign  communication”  that  is  “of*  or 
“concerning”  a  United  States  person,  as  described  above.  The  MCT  containing  that 
communication  remains  available  to  analysts  in  NSA’s  repositories  without  any  marking 
to  indicate  that  it  has  been  identified  as  an  MCT  or  as  a  transaction  containing  United 
States  person  information. 

•  If  the  discrete  communication  sought  to  be  used  is  not  to,  from,  or  about  a  tasked 
selector,  and  also  not  to  or  from  an  identifiable  United  States  person,  “that 
communication  (including  any  U.S.  person  information  therein)  will  be  handled  in 
accordance  with  the  NSA  minimization  procedures.”  Mi  at  8-9.“  Presumably,  this 
means  that  the  discrete  communication  will  be  treated  as  a  “foreign  communication”  or,  if 
it  contains  information  concerning  a  United  States  person,  as  a  “foreign  communication” 
“concerning  a  United  States  person,”  as  described  above.  The  MCT  itself  remains 
available  to  analysts  in  NSA’s  repositories  without  any  marking  to  indicate  that  it  lias 
been  identified  as  an  MCT  or  that  it  contains  one  or  more  communications  that  are  not  to, 
from,  or  about  a  targeted  selector. 


**  A  transaction  that  is  identified  as  an  SCT  rather  than  an  MCT  must  be  handled  in 
accordance  with  the  standard  minimization  procedures  that  are  discussed  above. 

“  The  Court  understands  that  absent  contrary  information,  NSA  treats  tire  user  of  an 
account  who  appears  to  be  located  in  the  United  States  as  “an  identifiable  U.S.  person.” 

Aug.  30  Submission  at  9  n.7  (“To  help  determine  whether  a  discrete  communication  not  to,  from, 
or  about  a  tasked  selector  is  to  or  from  a  U.S,  person,  NSA  would  perform  the  same  sort  of 
technical  analysis  it  would  perform  before  tasking  an  electronic  communications 
account/address/identifier  in  accordance  with  its  section  702  targeting  procedures.”). 
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•  A  discrete  communication  that  is  not  to,  from,  or  about  a  tasked  selector  but  that  is  to  or 
from  an  identifiable  United  States  pereon  “cannot  be  used  for  any  purpose  other  than  to 
protect  against  an  immediate  threat  to  human  life  (e.g.,  force  protection  or  hostage 
situations).”  M,  at  9.  Presumably,  this  is  a  reference  to  Section  1  of  the  minimization 
procedures,  which  allows  NSA  to  deviate  from  the  procedures  in  such  narrow 
circumstances,  subject  to  the  requirement  that  prompt  notice  be  given  to  the  Office  of  the 
Director  of  National  Intelligence,  the  Department  of  Justice,  and  the  Court  that  the 
deviation  has  occurred.  Regardless  of  whether  or  not  the  discrete  communication  is  used 
for  this  limited  purpose,  the  MCT  itself  remains  in  NSA’s  databases  without  any  marking 
to  indicate  that  it  is  an  MCT,  or  that  it  contains  at  least  one  commumcation  that  is  to  or 
from  an  identifiable  United  States  person.  Sse  14;  Sept.  7, 201 1  Hearing  Tr.  at  61. 

•  If  the  discrete  communication  sought  to  be  used  by  the  analyst  (or  another  discrete 
communication  within  the  MCT)  is  recognized  as  being  wholly  domestic,  the  entire  MCT 
will  be  purged  from  NSA’s  systems.  Sge  Aug,  30  Submission  at  3. 

c.  Statutory  Analysis 
i.  Acquisition 

The  Court  first  considers  how  NSA’s  proposed  handling  of  MCTs  bears  on  whether 
NSA’s  minimization  procedures  are  “reasonably  designed  in  light  of  the  purpose  and  technique 
of  the  particular  surveillance,  to  minimize  the  acquisition  ...  of  nonpublicly  available 
information  concerning  unconsenting  United  States  persons  consistent  with  the  need  of  the 
United  States  to  obtain,  produce,  and  disseminate  foreign  intelligence  information.”  SSS  50 
U.S.C.  §  1801(hXl)  (emphasis  added).  Insofar  as  NSA  likely  acquires  approximately  2,000- 
10,000  MCTs  each  year  that  contain  at  least  one  wholly  domestic  communication  that  is  neither 
to,  from,  nor  about  a  targeted  selector  and  tens  of  thousands  of  communications  of  or 


”  As  noted  above,  NSA’s  upstream  collection  also  likely  results  in  the  acquisition  of  tens 

(continued...) 
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concerning  United  States  persons  with  no  direct  connection  to  any  target,  the  Court  has  serious 
concerns.  The  acquisition  of  such  non-target  communications,  which  are  highly  unlikely  to  have 
foreign  intelligence  value,  obviously  does  not  by  itself  serve  the  government’s  need  to  “obtain, 
produce,  and  disseminate  foreign  intelligence  information.”  figs  50  U.S.C.  §  1801(h)(1). 

The  government  submits,  however,  that  the  portions  of  MCTs  that  contain  references  to 
targeted  selectors  are  likely  to  contain  foreign  intelligence  information,  and  that  it  is  not  feasible 
for  NSA  to  limit  its  collection  only  to  the  relevant  portion  or  portions  of  each  MCT  -  Le,.,  the 
particular  discrete  communications  that  are  to,  from,  or  about  a  targeted  selector.  The  Court 


“(...continued) 

of  thousands  of  wholly  domestic  SCTs  that  contain  refergnces  to  targeted  selectors.  See  sunra. 

;es  33-’34  &  note  33  (discussing  the  limitsi _ _ 

Although  the  collection  of  wholly 
domestic  “about”  SCTs  is  troubling,  they  do  not  raise  the  same  minimization-related  concerns  as 
discrete,  wholly  domestic  communications  that  are  neither  to,  jBrom,  nor  about  targeted  selectors, 
or  as  discrete  communications  of  or  concerning  United  States  persons  with  no  direct  connection 
to  any  target,  either  of  which  may  be  contained  within  MCTs.  The  Court  has  effectively 
concluded  that  certton  communications  containing  a  reference  to  a  targeted  selector  are 
reasonably  likely  to  contain  foreign  intelligence  information,  including  communications  between 
non-target  accounts  that  contain  tiie  name  of  the  targeted  facility  in  the  body  of  the  message.  See 
Docket  No.  07-449,  May  3 1, 2007  Primary  Order  at  12  (finding  probable  cause  to  believe  that 
certain  “about”  communications  were  “themselves  being  sent  and/or  received  by  one  of  the 
targeted  foreign  powem”).  Insofar  as  the  discrete,  wholly  domestic  “about”  communications  at 
issue  here  are  communications  between  non-target  accounts  that  contain  the  name  of  the  targeted 
facility,  the  same  conclusion  applies  to  them.  Accordingly,  in  the  language  of  FISA’s  definition 
of  minimization  procedures,  the  acquisition  of  wholly  domestic  communications  about  targeted 
selectors  will  generally  be  “consistent  with  the  need  of  the  United  States  to  obtain,  produce,  and 
disseminate  foreign  intelligence  information.”  Sss  50  U.S.C.  1801(h)(1).  Nevertheless,  the 
Court  understands  that  in  the  event  NSA  identifies  a  discrete,  wholly  domestic  “about” 
communication  in  its  databases,  the  communication  will  be  destroyed  upon  recognition.  See 
NSA  Minimization  Procedures  §  5. 
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accepts  the  government’s  assertion  that  the  collection  of  MCTs  yields  valuable  foreign, 
intelligence  infonnation  that  by  its  nature  cannot  be  acquired  except  through  upstream  collection. 
Sec  Sept.  7, 201 1  Hearing  Tr.  at  69-70, 74.  For  purposes  of  this  discussion,  the  Court  further 
accepts  the  government’s  assertion  that  it  is  not  feasible  for  NSA  to  avoid  the  collection  of  MCTs 
as  part  of  its  upstream  collection  or  to  limit  its  collection  only  to  the  specific  portion  or  portions 
of  each  transaction  that  contains  the  targeted  selector.  See  at  48-50;  June  1  Submission  at 
27.^^  The  Court  therefore  concludes  that  NSA’s  minimization  procedures  are,  given  the  current 
state  of  NSA’s  technical  capability,  reasonably  designed  to  minimize  the  acquisition  of 
nonpublicly  available  information  concerning  unconsenting  United  States  persons  consistent  with 
the  need  of  the  United  States  to  obtain,  produce,  and  disseminate  foreign  intelligence 
information. 


In  any  event,  it  is  incumbent  upon  NSA  to  continue  working  to  enhance  its  capability  to 
limit  acquisitions  only  to  targeted  communicatiotts. 
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H.  Retention 

The  principal  problem  with  the  government’s  'proposed  handling  of  MCTs  relates  to  what 
will  occur,  and  what  will  net  occur,  following  acquisition.  As  noted  above,  the  NSA 
minimization  procedures  generally  require  that,  “[ajs  a  communication  is  reviewed,  NSA 
analyst(s)  will  determine  whether  it  is  a  domestic  or  foreign  communication  to,  from,  or  about  a 
target  and  is  reasonably  believed  to  contain  foreign  intelligence  information  or  evidence  of  a 
crime,”  seg  NSA  Minimization  Procedures  §  3(b)(4),  so  that  it  can  be  promptly  afforded  the 
appropriate  treatment  under  the  procedums.  The  measures  proposed  by  the  government  for 
MCTs,  however,  largely  dispense  with  the  requirement  of  prompt  disposition  upon  initial  review 
by  an  analyst.  Rather  than  attempting  to  identify  and  segregate  information  “not  relevant  to  the 
authoiizied  purpose  of  the  acquisition”  or  to  destroy  such  information  promptly  following 
acquisition,  NSA’s  proposed  handling  of  MCTs  tends  to  maximize  the  retention  of  such 
information,  including  information  of  or  concerning  United  States  persons  with  no  direct 
connection  to  any  target.  §££  Mt  §  3(b)(1). 

The  proposed  measures  focus  almost  exclusively  on  the  discrete  communications  within 
MCTs  that  analysts  decide,  after  review,  that  they  wish  to  use.  Sss  Aug.  30  Submission  at  8- 1 0. 
An  analyst  is  not  obligated  to  do  anything  with  other  portions  of  the  MCT,  including  any  wholly 
domestic  discrete  communications tiiat  are  not  immediately  recognized  as  such,  and 
communications  of  or  concerning  United  States  persons  that  have  no  direct  connection  to  the 
targeted  selector.  Sss  Mtl  Sept.  7, 2011  Hearing  Tr.  at  61 .  If,  after  reviewing  the  contents  of  an 
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entire  MCT,  the  analyst  decides  that  he  or  she  does  not  wish  to  use  any  discrete  communication 

contained  therein,  the  analyst  is  not  obligated  to  do  anything  unless  it  is  immediately  apparent  to 

him  or  her  that  the  MCT  contains  a  wholly  domestic  communication  (in  which  case  the  entire 

MCT  is  deleted).”  See  Aug.  30  Submission  at  8-10. 

Except  in  the  case  of  those  recognized  as  containing  at  least  one  wholly  domestic 
communication,  MCTs  that  have  been  reviewed  by  analysts  remain  available  to  other  analysts  in 
NSA’s  repositories  without  any  marking  to  identify  them  as  MCTs.  ^  Sept.  7, 201 1 
Hearing  Tr.  at  61 .  Nor  will  MCTs  be  marked  to  identify  them  as  containing  discrete 
communications  to  or  from  United  States  persons  but  not  to  or  from  a  targeted  selector,  or  to 
indicate  that  they  contain  United  States  person  information.  ^  Aug.  30  Submission  at  8-10; 
Sept.  7, 201 1  Hearing  Tr.  at  61.  All  MCTs  except  those  identified  as  containing  one  or  more 
wholly  domestic  communications  will  be  retained  for  a  minimum  of  five  years.  The  net  effect  is 
that  thousands  of  wholly  domestic  communications  (those  that  are  never  reviewed  and  those  that 
are  not  recognized  by  analysts  as  being  wholly  domestic),  and  thousands  of  other  discrete 


”  The  government’s  submissions  make  clear  that,  in  many  cases,  it  will  be  difficult  for 
analysts  to  determine  whether  a  discrete  communication  contained  within  an  MCT  is  a  wholly 
domestic  communication.  NSA’s  recent  manual  review  of  a  six-month  representative  sample  of 
its  upstream  collection  demonstrates  how  challenging  it  can  be  for  NSA  to  recognize  wholly 
domestic  communications,  even  when  the  agency’s  full  attention  and  effort  are  directed  at  the 
task.  See  generally  Aug.  16  and  Aug.  30  Submissions.  It  is  doubtful  that  analysts  whose 
attention  and  effort  are  focused  on  identifying  and  analyzing  foreign  intelligence  information  will 
be  any  more  successful  in  identifying  wholly  domestic  communications.  Indeed,  each  year  the 
government  notifies  the  Court  of  numerous  compliance  incidents  involving  good-faith  mistakes 
and  omissions  by  NSA  personnel  who  work  with  the  Section  702  collection. 
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communications  that  are  not  to  or  from  a  targeted  selector  but  that  are  to,  from,  or  concerning  a 

United  States  person,  will  be  retained  by  NSA  for  at  least  five  years,  despite  the  fact  that  they 

have  no  direct  connection  to  a  targeted  selector  and,  dierefore,  are  unlikely  to  contain  foreign 

intelligence  information. 

It  appears  that  NSA  could  do  substantially  more  to  minimize  the  retention  of 
information  concerning  United  States  persons  that  is  unrelated  to  the  foreign  intelligence  purpose 
of  its  upstream  collection.  The  government  has  not,  for  instance,  demonstrated  why  it  would  not 
be  feasible  to  limit  access  to  upstream  acquisitions  to  a  smaller  group  of  specially-trained 
analysts  who  could  develop  expertise  in  identifying  and  scrutinizing  MCTs  for  wholly  domestic 
communications  and  other  di-screte  communications  of  or  concerning  United  States  persons, 
Alternatively,  it  is  unclear  why  an  analyst  working  within  the  framework  proposed  by  the 
government  should  not  be  required,  after  identifying  an  MCI,  to  apply  Section  3(b)(4)  of  the 
NSA  minimization  procedures  to  each  discrete  communication  within  the  transaction.  As  noted 
above,  Section  3(b)(4)  states  that  “[a]s  a  communication  is  reviewed,  NSA  analyst(s)  will 
determine  whether  it  is  a  domestic  or  foreign  communication  to,  from,  or  about  a  target  and  is 
reasonably  believed  to  contain  foreign  intelligence  information  or  evidence  of  a  crime."  NSA 
Minimization  Procedures  §  3(b)(4).  If  theMCT  contains  infonnation  "of’  or  "concerning”  a 
United  States  person  within  the  meaning  of  Sections  (2)(b)  and  (2)(c)  of  the  NSA  minimization 
procedures,  it  is  unclear  why  the  analyst  should  not  be  required  to  mark  it  to  identify  it  as  such. 
At  a  minimum,  it  seems  that  the  entire  MCT  could  be  marked  as  an  MCT.  Such  markings  would 
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alert  other  NSA  personnel  who  might  encounter  the  MCT  to  take  care  in  reviewing  it,  thus 

reducing  the  risk  of  error  that  seems  to  be  inherent  in  the  measures  proposed  by  the  government, 

which  are  applied  by  each  analyst,  acting  alone  and  without  the  benefit  of  his  or  her  colleagues’ 

prior  efforts.’®  Another  potentially  helpful  step  might  be  to  adopt  a  shorter  retention  period  for 

MCTs  and  unreviewed  upstream  communications  so  that  such  information  “ages  off’  and  is 

deleted  from  NSA’s  repositories  in  less  than  five  years. 

This  discussion  is  not  intended  to  provide  a  checklist  of  changes  that,  if  made,  would 
necessarily  bring  NSA’s  minimization  procedures  into  compliance  with  the  statute.  Indeed,  it 
may  be  that  some  of  these  measures  are  impracticable,  and  it  may  be  that  there  are  other  plausible 
(perhaps  even  belter)  steps  that  could  be  taken  that  are  not  mentioned  here.  But  by  not  firlly 
exploring  such  options,  the  government  has  failed  to  demonstrate  that  it  has  struck  a  reasonable 
balance  between  its  foreign  intelligence  needs  and  the  requirement  that  rnforraation  concerning 
Urrited  States  persons  be  protected.  Under  the  circumstances,  the  Court  is  unable  to  find  that,  as 
applied  to  MCTs  in  die  manner  proposed  by  the  government,  NSA’s  minimization  procedures 
are  “reasonably  designed  in  light  of  the  purpose  and  technique  of  the  particular  surveillance  to 
minimize  the . . .  retention . , .  of  noiqrublicly  available  information  concerning  unconsenting 


^  The  government  recently  acknowledged  that  “if  s  pretty  clear  that  it  would  be  better”  if 
NSA  used  such  markings  but  that  “[tjhe  feasibili^  of  doing  that  [had  not  yet  been]  assessed.” 
Sept.  7, 201 1  Hearing  Tr.  at  56. 
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United  States  persons  consistent  with  the  need  of  the  United  States  to  obtain,  produce,  and 

disseminate  foreign  intelligence  information gge  50  U.S.C.  §§  1801(h)(1)  &  1821(4)(A). 

Hi.  Dissemination 

The  Court  next  turns  to  dissemination.  At  the  outset,  it  must  be  noted  that  FISA  imposes 
a  stricter  standard  for  dissemination  than  for  acquisition  or  retention.  While  the  statute  requires 
procedures  that  are  reasonably  designed  to  “minimize”  the  acquisition  and  retention  of 
information  concerning  United  States  persons  consistent  with  the  need  of  the  United  States  to 
obtain,  produce,  and  disseminate  foreign  intelligence  information,  the  procedures  must  be 
reasonably  designed  to  “prohibit”  the  dissemination  of  information  concerning  United  States 
persons  consistent  with  that  need.  ^  50  U.S.C.  §  1801(h)(1)  (emphasis  added). 


”  NSA’s  minimization  procedures  contain  two  provisions  that  state,  in  part,  that  “[t]he 
communications  that  may  be  retained  [by  NS  A]  include  electronic  communications  acquired 
because  of  limitations 


The  government  fiirther  represented  that  it  “ha[d]  not  seen”  such  a 
circumstance  in  collection  under  the  Protect  America  Act  (“PAA”),  which  was  the  predecessor  to 
Section  702,  W.  at  29, 30.  And  although  NS  A  apparently  was  acquiring  Internet  transactions 
under  the  PAA,  the  government  made  no  mention  of  such  acquisitions  in  connection  with  these 
provisions  of  the  minimization  procedures  (or  otherwise).  Mi  at  27-3 1.  Accordingly,  the 
Court  does  not  read  this  language  as  purporting  to  justify  the  procedures  proposed  by  the 
government  for  MCTs.  In  any  event,  such  a  reading  would,  for  the  reasons  stated,  be 
inconsistent  with  the  statutory  requirements  for  minimization. 
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As  the  Court  understands  it,  no  United  States-person-identifying  information  contained  In 

any  MCT  will  be  disseminated  except  in  accordance  with  the  general  requirements  of  NSA’s 

minimization  procedures  for  “foreign  communications”  “of  or  concerning  United  States  persons” 

that  are  discussed  above.  Specifically,  “[a]  report  based  on  communications  of  or  concerning  a 

United  States  person  may  be  disseminated”  only  “if  the  identity  of  the  United  States  person  is 

deleted  and  a  generic  term  or  symbol  is  substituted  so  that  the  information  cannot  reasonably  be 

connected  with  an  identifiable  United  States  person.”  NSA  Minimization  Procedures  §  6(b).  A 

report  including  the  identity  of  the  United  States  person  may  be  provided  to  a  “recipient  requiring 

the  identity  of  such  person  for  die  performance  of  official  duties,”  but  only  if  at  least  one  of  eight 

requirements  is  also  met  -  for  instance,  if  “the  identity  of  the  United  States  person  is  necessary  to 

understand  foreign  intelligence  information  or  assess  its  importance.”  Id.^^ 

This  limitation  on  the  dissemination  of  United  States-person-identiiying  information  is 

helpful.  But  the  pertinent  portion  of  FISA’s  definition  of  minimization  procedures  applies  not 

merely  to  information  that  identifies  United  States  persons,  but  mom  broadly  to  the 

dissemination  of  “information  concerning  unconsenting  United  States  persons.”  50  U.S.C.  § 

1 801(h)(1)  (emphasis  added).^®  The  government  has  proposed  several  additional  restrictions  that 

Although  Section  6(b)  uses  the  term  “report,”  the  Court  imderstands  it  to  apply  to  the 
dissemination  of  United  States-person-identifying  information  in  any  form. 

Another  provision  of  the  definition  of  minimization  procedures  bars  the  dissemination 
of  information  (other  than  certain  forms  of  foreign  intelligence  information)  “in  a  manner  that 

(continued...) 
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will  have  the  effect  of  limiting  the  dissemination  of  "nonpablicly  available  information 

concerning  unconsenting  United  States  persons  consistent  with  the  need  of  the  United  States  to 

disseminate  foreign  intelligence  information.”  Mi  First,  as  noted  above,  the  government  will 

destroy  MCTs  that  are  recognized  by  analysts  as  containing  one  or  more  discrete  wholly 

domestic  communications.  Second,  the  government  has  asserted  that  NS  A  will  not  use  any 

discrete  communication  within  an  MCT  that  is  determined  to  be  to  or  from  a  United  States 

person  but  not  to,  from,  or  about  a  targeted  selector,  except  when  necessary  to  protect  against  an 

immediate  threat  to  human  life.  See  Aug.  30  Submission  at  9.  The  Court  understands  this  to 

mean,  among  other  things,  that  no  information  from  such  a  commimication  will  be  disseminated 

in  any  form  unless  NS  A  determines  it  is  necessary  to  serve  this  .specific  purpose.  Third,  the 

government  has  represented  that  whenever  it  is  unable  to  confirm  that  at  least  one  party  to  a 

discrete  communication  contained  in  an  MCT  is  located  outside  the  United  States,  it  will  not  use 

any  information  contained  in  the  discrete  communication.  See  Sept.  7, 201 1  Hearing  Ti.  at  52. 

The  Court  understands  this  limitation  to  mean  that  no  information  from  such  a  discrete 

communication  will  be  disseminated  by  NSA  in  any  form. 

Communications  as  to  which  a  United  States  person  or  a  person  inside  the  United  States 


^’(...continued) 

identifies  any  United  States  person,”  except  when  the  person’s  identity  is  necessary  to  understand 
foreign  intelligence  information  or  to  assess  its  importance.  Sse  50  U.S.C.  §§  1801  (h)(2), 

1 821  (4)(b).  Congress’s  use  of  the  distinct  modifying  terms  “concerning”  and  “identifying”  in 
two  adjacent  and  closely-related  provisions  was  presumably  intended  to  have  meaning,  §£s,  e.g,. 
Russello  V.  United  States.  464  U.S.  16,23  (1983). 
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is  a  party  are  more  likely  than  other  communications  to  contain  information  concerning  United 

States  persons.  And  when  such  a  communication  is  neither  to,  from,  nor  about  a  targeted  facility, 

it  is  highly  unlikely  that  the  “need  of  the  United  States  to  disseminate  foreign  intelligence 

information”  would  be  served  by  the  dissemination  of  United  States-person  information 

contained  therein.  Hence,  taken  together,  these  measures  will  tend  to  prohibit  the  dissemination 

of  information  concerning  unconsenting  United  States  persons  when  there  is  no  foreign- 

intelligence  need  to  do  so.*  Of  course,  the  risk  remains  that  information  concerning  United 

States  persons  will  not  be  recognized  by  NSA  despite  the  good-faith  application  of  the  measures 

it  proposes.  But  the  Court  cannot  say  that  the  risk  is  so  great  that  it  undermines  the 

reasonableness  of  the  measures  proposed  by  NSA  with  respect  to  the  dissemination  of 

information  concerning  United  States  persons.**  Accordingly,  the  Court  concludes  that  NSA’s 


***  Another  measure  that,  on  balance,  is  likely  to  mitigate  somewhat  the  risk  that 
information  concerning  United  States  persons  will  be  disseminated  in  the  absence  of  a  foreign- 
intelligence  need  is  the  recently-proposed  prohibition  on  running  queries  of  the  Section  .702 
upstream  collection  using  United  States-person  identifiers.  Ss£  Aug.  30  Submission  at  1 0-1 1, 
To  be  sure,  any  query,  including  a  query  based  on  non-United  States-person  information,  could 
yield  United  States-person  information.  Nevertheless,  it  stands  to  reason  that  queries  based  on 
information  concerning  United  States  persons  are  at  least  somewhat  more  likely  than  other 
queries  to  yield  United  States-person  information.  Insofar  as  information  concerning  United 
States  persons  is  not  made  available  to  analysts,  it  cannot  be  disseminated.  Of  course,  this 
querying  restriction  does  not  address  the  retention  problem  that  is  discussed  above. 

*'  In  reaching  this  conclusion  regarding  the  risk  that  information  concerning  United 
States  per.sons  might  be  mistakenly  disseminated,  the  Court  is  mindful  that  by  taking  additional 
steps  to  minimize  the  retention  of  such  information,  NSA  would  also  be  reducing  the  likelihood 
that  it  might  be  dis.seminated  when  the  government  has  no  foreign  intelligence  need  to  do  so. 
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minimization  procedures  are  reasonably  designed  to  “prohibit  the  dissemination[]  of  nonpublicly 

available  information  concerning  unconsenting  United  States  persons  consistent  with  the  need  of 

the  United  States  to . . .  disseminate  foreign  intelligence  information.”  See  50  U.S.C. 

§  1801(hXl)5 


4,  NSA*S  Targeting  and  Minimization  Procedures  Do  Not  as 

Applied  to  Upstream  Collection  that  Includes  MCTs.  Satisfy  die 
Requirements  of  the  Fourth  Amendment 

The  final  question  for  the  Court  is  whether  the  targeting  and  minimization  procedures  are, 
as  applied  to  upstream  collection  that  includes  MCTs,  consistent  with  the  Fourth  Amendment, 

50  U.S.C.  §  1881a(iX3)(A)-(B).  The  Fourth  Amendment  provides: 

The  right  of  the  people  to  be  secure  in  their  persons,  houses,  papers,  and 
effects,  against  unreasonable  searches  and  seizures,  shall  not  be  violated,  and  no 
Warrants  shall  issue,  but  upon  probable  cause,  supported  by  Oath  or  affirmation, 
and  particularly  describing  the  place  to  be  searched,  and  the  persons  or  things  to 
be  seized. 

The  Court  has  assumed  in  the  prior  Section  702  Dockets  that  at  least  in  some 
circimistances,  account  holders  have  a  reasonable  expectation  of  privacy  in  electronic 
communications,  and  hence  that  the  acquisition  of  such  communications  can  result  in  a  “search” 
or  “seizure”  within  the  meaning  of  the  Fourth  Amendment.  See,  e.g..  Docket  No.  HHIHI 
llfllllllllllllll^^  The  government  accepts  the  proposition  that  the  acquisition  of 


“  The  Court  further  concludes  that  the  NSA  minimization  procedures,  as  the  government 
proposes  to  apply  them  to  MCTs,  satisfy  the  requirements  of  50  U.S.C,  §§  1801(hX2)-(3)  and 
1 821  (4)CB)-(C),  Seg  supra,  note  59  (discussing  50  U.S.C.  §§  1 801  (h)(2)  &  1821(4)(B)).  The 
requirements  of  50  U.S.C.  §§  1801(li)(4)and  1 82 1(4)(D)  are  inapplicable  here. 
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electronic  communications  can  result  in  a  ‘'search”  or  “seizure”  under  the  Fourth  Amendment. 
See  Sept.  7, 201 1  Hearing  Tr,  at  66.  Indeed,  the  government  has  acknowledged  in  prior  Section 
702  matters  that  the  acquisition  of  communications  from  facilities  used  by  United  States  persons 
located  outside  the  United  States  “must  be  in  conformity  with  the  Fourth  Amendment”  Docket 

The  same  is  true 

of  the  acquisition  of  communications  horn  facilities  used  by  United  States  persons  and  others 
within  the  United  States.  Sm  United  States  v.  Verduco-Urquidez.  494  U.S.  259, 271  (1990) 
(recognizing  that  “aliens  receive  constitutional  protections  when  tliey  have  come  within  the 
territory  of  the  United  States  and  developed  substantial  comiections  with  this  country”), 
a.  The  Warrant  Requirement 

The  Court  has  previously  concluded  that  the  acquisition  of  foreign  intelligence 
information  pursuant  to  Section  702  falls  within  the  “foreign  intelligence  exception”  to  the 
warrant  requirement  of  the  Fourth  Amendment.  See  Docket  No.  ||||mmim||||||||| 
mmilllll^m.  The  govemmenFs  recent  revelations  regarding  NSA‘s  acquisition  of  MCTs 
do  not  alter  that  conclusion.  To  be  sure,  the  Court  now  understands  that,  as  a  r^uit  of  the 
transactional  nature  of  the  upsheani  collection,  NSA  acquires  a  substantially  larger  number  of 
communications  of  or  concerning  United  States  persons  and  persom  inside  the  United  States 
than  previously  understood.  Nevertheless,  the  collection  as  a  whole  is  still  directed  atH^^ 


conducted  for  the  purpose  of  national  security  -  a 
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purpose  going  "‘well  beyond  any  garden-varie^  law  enforcement  objective.  Ssg  jd^  (quoting 

In  re  Directives.  Docket  No.  08-01,  Opinion  at  16  (FISA  Ct.  Rev.  Aug.  22, 2008)  (hereinafter 

"In  re  Directives”!!.*^  Further,  it  remains  true  that  the  collection  is  undertaken  in  circumstances 

in  which  there  is  a  "‘high  degree  of  probability  that  requiring  a  warrant  would  hinder  the 

government’s  ability  to  collect  time-sensitive  information  and,  thus,  would  impede  the  vital 

national  security  interests  that  are  at  stake.’’’  Idi  at  36  (quoting  In  re  Directives  at  18). 

Accordingly,  the  government’s  revelation  that  NSA  acquires  MCTs  as  part  of  its  Section  702 

upstream  collection  does  not  disturb  the  Court’s  prior  conclusion  that  the  government  is  not 

required  to  obtain  a  warrant  before  conducting  acquisitions  under  NSA’s  targeting  and 

minimization  procedures. 

b.  Reasonableness 

The  question  therefore  becomes  whether,  taking  into  account  NSA’s  acquisition  and 
proposed  handling  of  MCTs,  the  agency’s  targeting  and  minimization  procedures  are  reasonable 
under  the  Fourth  Amendment.  As  the  Foreign  Intelligence  Surveillance  Court  of  Review  (“Court 
of  Review’’)  has  explained,  a  court  assessing  reasonableness  in  this  context  must  consider  “the 
nature  of  the  government  intrusion  and  how  the  government  intrusion  is  implemented.  The  more 
important  the  government’s  interest,  the  greater  the  intrasion  that  may  be  constitutionally 


®  A  redacted,  de-classified  version  of  the  opinion  in  In  re  Directives  is  published  at  55 1 
F.3d  1 004.  The  citations  herein  are  to  the  unredacted,  classified  version  of  the  opinion. 
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tolerated."  In  re  Directives  at  19-20  (citations  omitted),  quoted  in  Docket  No|[||||||||||||^ 

The  court  must  therefore 

balance  the  interests  at  stake.  If  the  protections  that  are  in  place  for  individual 
privacy  interests  are  sufficient  in  light  of  the  government  interest  at  stake,  the 
constitutional  scales  will  tilt  in  favor  of  ui^oldingthe  government’s  actions.  If, 
however,  those  protections  are  insufficient  to  alleviate  the  risks  of  government 
error  and  abuse,  the  scales  will  tip  toward  a  finding  of  unconstitutionality. 

14,  at  20  (citations  omitted),  quoted  in  Docket  No||||||||||||[||||||||||||||^^^^^||^ 

In  conducting  tliis  balancbg,  the  Court  must  consider  the  “totality  of  the  circumstances.”  Id.  at 

19.  Given  the  all-encompassing  nature  of  Fourth  Amendment  reasonableness  review,  the 

targeting  and  minimization  procedures  are  most  appropriately  considered  collectively.  See 

Docket  No,  (following  the  same  approach).^ 

The  Court  has  previously  recognized  that  the  government’s  national  security  interest  in 

conducting  acquisitions  pursuant  to  Section  702  ‘“is  of  the  highest  order  of  magnitude.’”  Docket 

No.  iiiiiiiiiiiiiiiillllligil^^  (quoting  In  re  Directives  at  20).  The  Court  has 

further  accepted  the  government’s  representations  that  NSA’s  upstream  collection  is  “‘uniquely 

capable  of  acquiring  certain  types  of  targeted  communications  containing  valuable  foreign 

intelligence  information.’”  Docket  No.  IBHHHHHHHHHHIi  (quoting 


“  Reasonableness  review  under  the  Fourth  Amendment  is  broader  than  the  statutory 
assessment  previously  addressed,  which  is  necessarily  limited  by  the  terms  of  the  pertinent 
provisions  of  FISA. 
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government  filing).  There  is  no  reason  to  believe  that  the  collection  of  MCTs  results  in  the 
acquisition  of  less  foreign  intelligence  information  than  the  Court  previously  understood. 

Nevertheless,  it  must  be  noted  that  NSA’s  upstream  collection  makes  up  only  a  very 
small  fraction  of  the  agency’ s  total  collection  pursuant  to  Section  702.  As  explained  above,  the 
collection  of  telephone  communications  under  Section  702  is  not  implicated  at  all  by  the 
government’s  recent  disclosures  regarding  NSA’s  acquisition  of  MCTs.  Nor  do  those  disclosures 
affect  NSA’s  collection  of  Internet  communications  directly  from  Internet  service  providersdj 
llljllllllllll^lllllllll^  which  accounts  for  approximately  91  %  of  the  Internet 

communications  acquired  by  NSA  each  year  under  Section  702.  SSS  Aug.  16  Submission  at 
Appendix  A.  And  the  government  recently  advised  that  NSA  now  has  the  capability,  at  the  time 
of  acquisition,  to  identify  approximately  40%  of  its  upstream  collection  as  constituting  discrete 
communications  (non-MCTs)  that  are  to,  from,  or  about  a  targeted  selector.  Sgg  idi  at  I  n.2. 
Accordingly,  only  approximately  5.4%  (40%  of  9%)  ofNSA’s  aggregate  collection  of  Internet 
communications  (and  an  even  smaller  portion  of  the  total  collection)  under  Section  702  is  at 
issue  here.  The  national  security  interest  at  stake  must  be  assessed  bearing  these  numbers  in 
mind. 

The  government’s  recent  disclosures  regarding  the  acquisition  of  MCTs  most  directly 
affect  the  privacy  side  of  the  Fourth  Amendment  balance.  The  Court’s  prior  approvals  of  the 
targeting  and  minimization  procedures  rested  on  its  conclusion  that  the  procedures  “reasonably 
confine  acquisitions  to  targets  who  are  non-U.S.  persons  outside  the  United  States,”  who  thus 
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“are  not  protected  by  the  Fourth  Amendment.”  Docket  No| 

||[|||||||||[H  The  Court’s  approvals  also  rested  upon  ti^  undei^tandmg  that  acquisitions  under  the 

procedures  “will  intrude  on  interests  protected  by  the  Fourtii  Amendment  only  to  the  extent  tiiat 

(1)  despite  the  operation  of  the  tat^geting  procedures,  U.S.  persons,  or  persons  actually  in  the 

United  States,  are  mistakenly  targeted;  or  (2)  U.S,  persons,  or  persons  located  in  the  United 

States,  are  parties  to  communications  to  or  from  tasked  selectors  (or,  in  certain  circumstances, 

communications  that  contain  a  reference  to  a  tasked  selector).”  Id  at  38.  But  NSA’s  acquisition 

of  MCTs  substantially  broadens  the  circumstances  in  which  Fourth  Amendment-protected 

interests  are  intruded  upon  by  NSA’s  Section  702  collection.  Until  now,  the  Court  has  not 

considered  these  acquisitions  in  its  Fourth  Amendment  analysis. 

Both  in  terms  of  its  size  and  its  nature,  the  intrusion  resulting  from  NSA’s  acquisition  of 

MCTs  is  substantial.  The  Court  now  understands  that  each  year,  NSA’s  upstream  collection 

likely  results  in  the  acquisition  of  roughly  two  to  ten  thousand  discrete  wholly  domestic 

communications  that  are  neither  to,  from,  nor  about  a  targeted  selector,  as  well  as  tens  of 

thousands  of  other  communications  that  are  to  or  from  a  United  States  person  or  a  person  in  the 

United  States  but  that  are  neither  to,  from,  nor  about  a  targeted  selector.®^  In  arguing  that  NSA’s 


As  discussed  earlier,  NSA  also  likely  acquires  tens  of  thousands  of  discrete,  wholly 
domestic  communications  that  are  “about”  a  targeted  fecility.  Because  these  communications  are 
reasonably  likely  to  contain  foreign  intelligence  information  and  thus,  generally  speaking,  serve 
the  government’s  foreign  intelligence  needs,  they  do  not  present  the  same  Fourth  Amendment 
concerns  as  the  non-target  communications  discussed  here.  Sgg  supra,  note  53. 


TOP  SECRE-T//COMBff//ORCON,NOFORN 


Page  72 


NSA-WIKI  00220 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  635  of  1298 

TOP  6ECRET//COmNTTVORCO]H>NOFOKN — 
targeting  and  minimization  procedures  satisfy  the  Fourth  Amendment  notwithstanding  the 

acquisition  of  MCTs,  the  government  stresses  that  the  number  of  protected  communications 

acquired  Is  relatively  small  in  comparison  to  the  total  number  of  Internet  communications 

obtained  by  NSA  through  its  upstream  collection.  That  is  true  enough,  given  the  enormous 

volume  of  Internet  transactions  acquired  by  NSA  through  its  upstream  collection  (approximately 

26.5  million  annually),  But  the  number  is  small  only  in  that  relative  sense.  The  Court  recognizes 

that  the  ratio  of  non-target,  Fourth  Amendment-protected  communications  to  the  total  number  of 

communications  must  be  considered  in  the  Fourth  Amendment  balancing.  But  in  conducting  a 

review  under  the  Constitution  that  requires  consideration  of  the  totality  of  the  circumstances,  see 

In  re  Directives  at  19,  the  Court  must  also  take  into  account  the  absolute  number  of  non-target, 

protected  communications  that  are  acquired.  In  absolute  terms,  tens  of  thousands  of  non-target, 

protected  communications  annually  is  a  very  large  number. 

The  nature  of  the  intrusion  at  issue  is  also  an  important  consideration  in  the  Fourth 
Amendment  balancing.  Sgg,  e.g..  Board  of  Educ.  v.  Earls.  536  U.S.  822, 832  (2002);  Vemonia 
Sch,  Dist.  47J  v.  Acton.  515  U.S.  646, 659  (1995).  At  issue  here  are  the  Pci'sonal||||||||||||[||||||^ 
communications  of  U.S.  persons  and  persons  in  the  United  States.  A  person’s  “papers”  are 
among  the  four  items  that  are  specifically  listed  in  the  Fourth  Amendment  as  subject  to 
protection  against  unreasonable  search  and  seizure.  Whether  they  are  transmitted  by  letter, 
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telephone  or  e-mail,  a  person’s  private  communications  are  akin  to  personal  papers.  Indeed,  the 

Supreme  Court  has  held  that  the  parties  to  telephone  communications  and  the  senders  and 

recipients  of  written  communications  generally  have  a  reasonable  expectation  of  privacy  in  the 

contents  of  those  communications.  Sss  Kate.  389  U.S.  at  352;  United  States  v.  United  States 

Dist.Ct.iKeith).  407  U.S.  297, 313  (1972);  Umted  States  v.  Jacobs^  466  U.S.  109, 1 14  (1984). 

Hie  intrusion  resulting  from  the  interception  of  the  contents  of  electronic  communications  is, 

generally  speaking,  no  less  substantial 

The  government  stresses  that  the  non-target  communications  of  concern  here  (discrete 
wholly  domestic  communications  and  other  discrete  communications  to  or  from  a  United  States 
person  or  a  person  in  the  United  States  that  are  neither  to,  from,  nor  about  a  targeted  selector)  are 
acquired  incidentally  rather  than  purposefully,  June  28  Submission  at  13-14.  Insofar  as 
NSA  acquires  entire  MCTs  because  it  lacks  the  technical  means  to  limit  collection  only  to  the 
discrete  portion  or  portions  of  each  MCT  that  contain  a  reference  to  the  targeted  selector,  the 
Court  is  satisfied  that  is  the  case.  But  as  the  government  correctly  recognizes,  the  acquisition  of 
non-target  information  is  not  necessarily  reasonable  under  the  Fourth  Amendment  simply 


“  Of  course,  not  every  interception  by  the  government  of  a  personal  communication 
results  in  a  “search”  or  “seizure”  within  the  meaning  of  the  Fourth  Amendment.  Whether  a 
particular  intrusion  constitutes  a  search  or  seizure  depends  on  the  specific  facts  and 
circumstances  involved. 
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because  its  collection  is  incidental  to  the  purpose  of  the  search  or  surveillance.  §£e  id.  at  14. 

There  surely  are  circumstances  in  which  incidental  intrusions  can  be  so  substantial  as  to  render*  a 
search  or  seizure  unreasonable.  To  use  an  extreme  example,  if  the  only  way  for  the  government 
to  obtain  conununications  to  or  from  a  particular  targeted  HHHHB  required  also  acquiring 
all  communications  to  or  from  every  other  |^m||||||m|,  such  collection  would  certainly  raise 
very  serious  Fourth  Amendment  concerns. 

Here,  the  quantity  and  nature  of  the  information  that  is  “incidentally”  collected 
distinguishes  this  matter  from  the  prior  instances  in  which  this  Court  and  the  Court  of  Review 
have  considered  incidental  acquisitions.  As  explained  above,  the  quantity  of  incidentally- 
acquired,  non-target,  protected  communications  being  acquired  by  NSA  through  its  upstream 
collection  is,  in  absolute  terms,  very  large,  and  the  resultmg  intrusion  is,  in  each  instance, 
likewise  very  substantial.  Arid  with  regard  to  the  nature  of  the  acquisition,  the  government 
acknowledged  in  a  prior  Section  702  docket  that  the  term  “incidental  interception”  is  “most 
commonly  understood  to  refer  to  an  intercepted  communication  between  a  target  using  a  facility 
subject  to  surveillance  and  athird  party  using  afacility  not  subject  to  surveillance.”  Docket  Nos. 

acquisition  that  the  Court  of  Review  was  addressing  in  In  re  Directives  when  it  stated  that 
"incidental  collections  occurring  as  a  result  of  constitutionally  permissible  acquisitions  do  not 
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render  those  acquisitions  unlawful In  re  Directives  at  30.  But  here,  by  contrast,  the  incidental 

acquisitions  of  concern  are  not  direct  communications  between  a  non-target  third  party  and  the 

user  of  the  targeted  facility.  Nor  are  they  the  communications  of  non-targets  that  refer  directly  to 

a  targeted  selector.  Rather,  the  communications  of  concern  here  are  acquired  simply  because 

they  appear  somewhere  in  the  Mime  transaction  as  a  separate  communication  that  is  to,  from,  or 

about  the  targeted  fecility.*^ 

The  distinction  is  significant  and  impacts  the  Fourth  Amendment  balancing.  A  discrete 
communication  as  to  which  the  user  of  the  targeted  facility  is  a  party  or  in  which  the  targeted 


The  Court  of  Review  plainly  limited  its  holding  regarding  incidental  collection  to  the 
facts  before  it.  Sge  In  re  Directives  at  30  /“On  these  facts,  incidentally  collected  communications 
of  non-targeted  United  States  persons  do  not  violate  the  Fourth  Amendment.”)  (emphasis  added). 
The  dispute  in  In  re  Directives  involved  the  acquisition  by  NSA  of  discrete  to/from 
communications  from  an  Internet  Service  Provider,  notNSA’s  upstream  collection  of  Internet 
transactions.  Accordingly,  the  Court  of  Review  had  no  occasion  to  consider  NSA’s  acquisition 
of  MCTs  (or  even  “abouf  ’  commrmications,  for  that  matter).  Furthermore,  the  Court  of  Review 
noted  that  “[t]he  government  assures  us  that  it  does  not  maintain  a  database  of  incidentally 
collected  information  from  non-targeted  United  States  persons,  and  there  is  no  evidence  to  the 
contrary.”  IdL  Here,  however,  the  government  proposes  measures  that  will  allow  NSA  to  retain 
non-target  United  States  person  information  in  its  databases  for  at  least  five  years. 

The  Title  III  cases  cited  by  the  government  (gge  June  28  Submission  at  14-15)  are 
likewise  distinguishable.  Abraham  v.  Countv  of  Greenville.  237  F.3d  386, 391  (4th  Cir.  2001), 
did  not  involve  incidental  overhears  at  all.  The  others  involved  allegedly  non-pertinent 
communications  to  or  from  the  facilities  for  which  wiretap  authorization  had  been  granted,  rather 
than  communications  to  or  from  non-targeted  facilities.  ^  Scott  v.  United  States.  436  U.S. 

128, 130-31  (1978),  United  States  v.  McKinnon.  721  F.2d  19, 23  (1st  Cir.  1983),  and  United 
States  v.  Doolittle.  507  F.2d  1368, 1371,  aff  d  en  banc,  518  F.2d  500  (5th  Cir.  1975). 
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facility  is  mentioned  is  much  more  likely  to  contain  foreign  intelligence  information  than  is  a 

separate  communication  that  is  acquired  simply  because  it  happens  to  be  within  the  same 

transaction  as  a  communication  involving  a  targeted  facility.  Hence,  the  national  security  need 

for  acquiring,  retaining,  and  disseminating  the  former  category  of  communications  is  greater  than 

the  justification  for  acquiring,  retaining,  and  disseminating  the  latter  form  of  communication. 

The  Court  of  Review  and  this  Court  have  recognized  that  the  procedures  governing 
retention,  use,  and  dissemination  bear  on  the  reasonableness  under  the  Fourth  Amendment  of  a 
program  for  collecting  foreign  intelligence  information.  §§e  In  re  Directives  at  29-30;  Docket 
No.  explained  in  the  discussion  of  NSA’s 

minimization  procedures  above,  the  measures  proposed  by  NSA  for  handling  MCTs  tend  to 
maximize,  rather  than  minimize,  the  retention  of  non-target  information,  including  information 
of  or  concerning  United  States  persons.  Instead  of  requiring  the  prompt  review  and  proper 
disposition  of  non-target  information  (to  the  extent  it  is  feasible  to  do  so),  NSA’s  proposed 
measures  focus  almost  exclusively  on  tiiose  portions  of  an  MCT  that  an  analyst  decides,  after 
review,  that  he  or  she  wishes  to  use.  An  analyst  is  not  required  to  determine  whether  other 
portions  of  the  MCT  constitute  discrete  communications  to  or  from  a  United  States  person  or  a 
person  in  the  United  States,  or  contain  information  coiKeming  a  United  States  person  or  person 
inside  the  United  States,  or,  having  made  such  a  determination,  to  do  anything  about  it.  Only 
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those  MCTs  that  are  immediately  recognized  as  containing  a  wholly  domestic  discrete 

communication  are  purged,  while  other  MCTs  remain  in  NSA’s  repositories  for  five  or  more 

years,  without  being  marked  as  MCTs.  Nor,  if  an  MCT  contains  a  discrete  communication  of,  or 

other  information  concerning,  a  United  States  person  or  person  m  the  United  States,  is  the  MCT 

marked  as  such.  Accordingly,  each  analyst  who  retrieves  an  MCT  and  wishes  to  use  a  portion 

thereof  is  left  to  apply  the  proposed  minimization  measures  alone,  ftom  beginning  to  end,  and 

without  the  benefit  of  his  colleagues’  prior  review  and  analysis.  Given  the  limited  review  of 

MCTs  that  is  required,  and  the  difficulty  of  the  task  of  identifying  protected  information  within 

an  MCT,  the  government’s  proposed  measures  seem  to  enhance,  rather  than  reduce,  the  risk  of 

error,  overretention,  and  dissemination  of  non-target  information,  including  information 

protected  by  the  Fourth  Amendment. 

In  sum,  NSA’s  collection  of  MCTs  results  in  the  acquisition  of  a  very  large  number  of 
Fourth  Amendment-protected  communications  that  have  no  direct  connection  to  any  targeted 
facility  and  thus  do  not  serve  the  national  security  needs  underlying  the  Section  702  collection  as 
a  whole.  Rather  than  attempting  to  identify  and  segregate  the  non-target,  Fourth-Amendment 
protected  information  promptly  following  acquisition,  NSA’s  proposed  handling  of  MCTs  tends 
to  maximize  the  retention  of  such  information  and  hence  to  enhance  the  risk  that  it  will  be  used 
and  disseminated.  Under  the  totalify  of  the  circumstances,  then,  the  Court  is  unable  to  find  that 
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the  goveramcnt’s  proposed  application  of  NS  A’s  targeting  and  minimization  procedures  to 
MCTs  is  consistent  with  the  requirements  of  the  Fourth  Amendment.  The  Court  does  not 
foreclose  the  possibility  that  the  government  might  be  able  to  tailor  the  scope  of  NS  A’s  upstream 
collection,  or  adopt  more  stringent  post-acquisition  safeguards,  in  a  manner  that  would  satisfy  the 
reasonableness  requirement  of  the  Fourth  Amendment.® 

V.  CONCLUSION 

For  the  foregoing  reasons,  the  government’s  requests  for  approval  of  the  certifications 
and  procedures  contained  in  the  April  2011  Submissions  are  granted  in  part  and  denied  in  part. 
The  Court  concludes  that  one  aspect  of  the  proposed  collection  -  the  ‘hrpstream  collection”  of 
Internet  transactions  containing  multiple  communications,  or  MCTs  -  is,  in  some  respects, 
deficient  on  statutory  and  constitutional  grounds.  Specifically,  the  Court  finds  as  follows: 

1.  C€tdfications|||||[|[||||||||||||||[||||||^^  and  the  amendments  to  the  Certifications 

in  the  Prior  702  Dockets,  contain  all  the  required  elements; 

As  the  government  notes,  gee  lune  1  Submission  at  18-19,  the  Supreme  Court  has 
“repeatedly  refiised  to  declare  that  only  the  ‘least  intrusive’  search  practicable  can  be  reasonable 
under  the  Fourth  Amendment.”  City  of  Ontario  v.  Ouon.  —  U.S.  — ,  130  S.  Ct  2619, 2632 
(2010)  (citations  and  internal  quotation  marks  omitted).  The  foregoing  discussion  should  not  be 
understood  to  suggest  otherwise.  Rather,  the  Court  holds  only  that  the  means  actually  chosen  by 
the  government  to  accomplish  its  Section  702  upstream  collection  are,  with  respect  to  MCTs, 
excessively  intrusive  in  light  of  the  purpose  of  the  collection  as  a  whole. 
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2.  As  applied  to  telephone  communications  and  discrete  Internet  communications  that 

are  to  or  from  a  facility  tasked  for  collection,  to  non-MCT  "‘about”  communications  falling 
within  th^HIIII  categories  previously  described  by  the  government,*’  and  to  MCTs  as  to  which  the 
“active  user”  is  known  to  be  a  tasked  selector,  the  targeting  and  minimization  procedures  adopted 
in  accordance  with  50  U.S.C.  §  1881a(d)-(e)  are  consistent  with  the  requirements  of  those 
subsections  and  with  the  Fourth  Amendment  to  the  Constitution  of  the  United  States; 

3.  NSA’s  targeting  procedures,  as  the  government  proposes  to  implement  them  in 
connection  with  the  acquisition  ofMCTs,  meet  the  requirements  of  50  U.S.C.  §  1881a{d); 

4.  NSA’s  minimization  procedures,  as  the  government  proposes  to  apply  them  to  MCTs 
as  to  which  the  “active  user”  is  not  known  to  be  a  tasked  selector,  do  not  meet  the  requirements 
of  50  U.S.C.  §  1 881a(e)  with  respect  to  retention;  and 

5.  NSA’s  targeting  and  minimization  procedures,  as  the  government  proposes  to  apply 
them  to  MCTs  as  to  which  the  "active  us«^’  is  not  known  to  be  a  tasked  selector,  are  inconsistent 
with  the  requirements  of  the  Fourth  Amendment. 


See  Docket  No. 
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Orders  approving  the  certifications  and  amendments  in  part  are  being  entered 

contemporaneously  herevvith. 

ENTERED  this  3rd  day  of  October,  2011, 


Judge,  United  States  Foreign 
Intelligence  Surveillance  Court 


1,  Deputy  Ciwk, 
FlSC.certtfy  that  Ibis  document 
ft  true  cofrtcl 

tbcorigmal.j 
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no 

1 

MS.  WALD: 

So  it  would  be  up  to  the 

2 

agency  to  decide  whether  they  thought  it  was  right 

3 

or  wrong  to  give  that  information  to  a  foreign 

4 

government? 

5 

MR .  DE : 

I  think  there's  two  points  to 

6 

mention.  One  is  no 

information  would  ever  be 

7 

disseminated  unless 

it  had  foreign  intelligence 

8 

value . 

9 

MS.  WALD: 

No,  I  know. 

10 

MR .  DE : 

That's  the  entire  point  of 

11 

disseminating  that 

information . 

12 

MS.  WALD: 

But  having  made  that 

13 

decision  in  terms  - 

- 

14 

MR .  DE : 

If  I  may  continue.  The  second 

15 

point  is  that  I  think  what  the  President  has 

16 

directed  the  DNI  to 

examine  in  the  PPD  is  what 

17 

protections  could  be  extended  to  non-U. S.  persons. 

18 

That's  the  study. 

19 

MS.  WALD: 

And  that ' s  what  you ' re 

20 

working  on? 

21 

MR .  DE : 

That's  the  issue  we're 

22 

evaluating  now. 
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298 

1 

privacy . 

2 

But 

I  think 

that ' s  --  there ' s  not  a 

3 

definition  of 

privacy. 

or  of  arbitrary,  or 

4 

unlawful  that 

is  binding  as  a  matter  of 

5 

international 

law . 

6 

MS. 

BRAND : 

Chris  or  Laura,  any 

7 

thoughts  on  that  question? 

8 

MS. 

RITTER: 

Would  you  repeat  that 

9 

question  again? 

10 

MS. 

BRAND : 

Just  what  does  privacy  mean 

11 

in  the  ICCPR 

context? 

Where  does  the  definition 

12 

come  from?  How  would 

you  find  the  definition? 

13 

MS. 

RITTER: 

Well,  it  guards  against 

14 

unlawful  and 

arbitrary  interference  with  an 

15 

individual ' s 

privacy. 

so  there  has  to  be  a  respect 

16 

for  correspondence,  for  example,  and  a  respect  for 

17 

an  individual's  personal  space,  and  there  has  to 

18 

be  an  ability 

to  have 

personal  space  to 

19 

communicate . 

20 

MS. 

BRAND : 

Where  are  you  getting  that 

21 

definition? 

22 

MS. 

RITTER: 

Well,  that's,  I  mean 
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TOPSECRET//COMfl'fT//ORCQN,NQrQRl^- 

Follow-up  Questions  Regarding  Section  702  Certifications 
June  17, 2011 


1.  The  government’s  Response  to  the  Court’s  Briefing  Order  of  May  9, 201 1  ("June  1 
Submission”)  states  that  Internet  transactions  acquired  by  NSA  in  its  upstream  collection  may 
contain  not  only  multiple  discrete  communications  (some  of  which  are  neither  to.  from,  nor  about 
a  tasked  selector),  but  also  I 

_  I  June  1  Submission 

at  25, 

a.  Please  provide  some  examples  of  the  I 


b.  What  is  the  likelihood  that  pertain  to  persons  other 

than  the  users  of  tasked  selectors,  including  persons  in  the  United  States  or  U.S.  persons? 


2.  The  June  1  Submission  states  that  “no  NSA  analyst  has  yet  discovered  in  NSA’s  repositories  a 
wholly  domestic  communication.”  June  1  Submission  at  9. 

a.  What  is  meant  by  “wholly  domestic  communication”  in  this  statement?  Does  the  term 
include  the  discrete  communications  that  might  be  embedded  within  acquired 
transactions? 

b.  What  is  the  likelihood  that  an  analyst  viewing  information  obtained  through  a 
transactional  acquisition  would  have  a  basis  for  determining  that  a  discrete 
communication  embedded  within  the  transaction  is  purely  domestic? 

3.  a.  Might  the  non-targeted  portion  of  a  transaction  ever  be  the  sole  basis  for  that 
transaction  being  responsive  to  an  analyst’s  query? 

b.  Upon  retrieving  information  in  response  to  a  query,  can  an  analyst  readily  distinguish 
that  portion  of  a  transaction  that  contains  the  targeted  selector  from  other  portions  of  a 
transaction? 

4.  a.  Please  describe  the  manner  in  which  the  government  minimizes  discrete 
communications  and  other  information  that  is  contained  within  acquired  Internet 
transactions  but  that  is  neither  to,  fi'om,  nor  about  the  user  of  a  targeted  selector. 

b.  In  particular,  please  explain  how  the  government  applies  the  provisions  of  NSA’s 
minimization  procedures  that  use  the  term  “communication”  to  the  discrete 
communications  and  other  non-target  information  contained  within  the  transactions  that 
are  acquired.  See,  e.g.,  NSA  Minimization  Procedures  §  2(c)  (defining 
“[c]ommunications  of  a  United  States  person”);  §  2(e)  (defining  “foreign 
communication”  and  "domestic  communicationQ”),  §  3(b)(4)  (discussing  determination 

_  whether  a  communicationis.i‘foreign’’.Qr. “domestic”),  and. §  5  (discussing  handling  of. _ 

domestic  communications). 
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c.  Would  all  communications  and  I 


I  within  a  transaction  be 


treated  the  same  when  the  minimization  procedures  are  applied,  or  would  there  be 
different  treatment? 


5.  a.  Once  NSA  has  identified  a  portion  of  a  transaction  that  does  not  contain  targeted 
information,  is  it  possible  to  mask  or  otherwise  minimize  the  non-target  information 
contained  within  the  transaction? 

b.  Why  is  NSA  unable  to  delete  and  replace,  or  alter,  an  original  transaction  that  contains 
non-target  information?  See  June  1  Submission  at  27-28. 


6.  The  government  states  that  an  Internet  transaction  that  is  acquired  “is ...  not  divisible  into  the 
discrete  communications  within  it  even  once  it  resides  in  an  NSA  corporate  store.”  June  1 
Submission  at  22.  Please  reconcile  that  statement  with  the  govenunent’s  acknowledgment  that 
“an  analyst  would ...  be  able  to  copy  a  portion  of  the  rendered  view  of  a  transaction  contained  in 
a  NSA  corporate  store  and  then  paste  it  into  a  new  record  on  a  different  system.”  Id  at  27  n.25. 


7.  Please  reconcile  the  government’s  statement  that  the  “communicants”  of  to/from 


communications  are ' 
with! 


e  1  Submission  at  30) 
elsewhere  in  its 


response  to  the  Court’s  questions  (^,  e.g..  id  at  6  (discussing  application  of  IP  filtering)). 


that  “a  United  States  person  would  use  I 

and  that ' 

See  Jime  1  Submission  at  11, 12. 

9.  What  is  the  factual  basis  for  NSA’s  suggestion  that  | 

HHH  See  June  1  Submission  at  8  n.9 


10.  The  government  repeatedly  characterizes  as  “unintentional” 
non-target  commimications  as  part  of  transactional  acquisitions. 

Assuming  arguendo  that  such  collection  can  fairly  be  characterized  as  unintentional,  please 
explain  how  50  U.S.C.  §  1806(i)  applies  to  the  discrete,  wholly  domestic  communications  that 
might  be  contained  within  a  particular  transaction. 


NSA’s  collection  of  discrete 


1 1 .  Please  provide  a  thorough  legal  analysis  supporting  your  view  that  the  knowing  and 
intentional  acquisition  of  large  volumes  of  Internet  transactions  containing  discrete 
communications  that  are  neither  to,  firom,  nor  about  a  targeted  selector  (as  well  as  other 
information  not  pertaining  to  the  users  of  targeted  selectors)  is  merely  “incidental”  to  the 
authorized  purpose  of  the  collection  as  a  whole,  and  therefore  reasonable  under  the  Fourth 
Amendment. 
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12.  The  statute  requires  the  targeting  procedures  to  “be  reasonably  designed  to  ensure  that  any 
acquisition ...  is  limited  to  targeting  persons  reasonably  believed  to  be  located  outside  the 
United  States  and  [to]  prevent  the  intentional  acquisition  of  any  communication  as  to  which  the 
sender  and  all  intended  recipients  are  known  at  the  time  of  the  acquisition  to  be  located  in  the 
United  States.”  50  U.S.C.  §  1881a(d)(l).  How  can  procedures  that  contemplate  the  knowing 
acquisition  of  huge  volumes  of  transactions  that  will  include  quantifiable  amounts  of  information 
relating  to  non-targets,  including  information  of  or  about  U.S.  persons  abroad  or  persons  located 
in  the  United  States,  meet  this  statutory  requirement? 


13.  In  its  discussion  of  the  Fourth  Amendment,  the  government  asserts  that  “upstream 
collection”  in  general  is  “an  essential  and  irreplaceable  means  of  acquiring  valuable  foreign 
intelligence  information  that  promotes  the  paramount  interest  of  protecting  the  Nation  and 
conducting  its  foreign  affairs.”  June  1  Submission  at  16. 

a.  To  what  extent  can  the  same  be  said  for  the  acquisition  of  Internet  transaction^^^l 

particular? 

b.  Is  the  acquisition  of  Internet  transactions  via  upstream  collection  the  only  source  for 
certain  categories  of  foreign  intelligence  information?  If  so,  what  categories? 

c.  Please  describe  with  particularity  what  information  NSA  would  acquire,  and  what 
information  NSA  would  not  acquire,  if  NSA  were,  in  comparison  to  its  current  collection, 
to  limit  its  acquisitionofhit^ietcommumcationsto^(l)acquisitionscoi^^  with  the 
assistance 

the  upstreamcollectionofdscretecommunication^o^ora^r  about  tasked  selectors 
are  (id. 


14.  The  Fourth  Amendment  also  requires  the  Court  to  examine  the  nature  and  scope  of  the 
intrusion  upon  protected  privacy  interests.  How  can  the  Court  conduct  such  an  assessment  if  the 
government  itself  is  unable  to  describe  the  nature  and  scope  of  the  information  that  is  acquired  or 
the  degree  to  which  the  collection  includes  information  pertaining  to  U.S.  persons  or  persons 
located  in  the  United  States? 


15.  In  light  of  the  government’s  emphasis  on  the  limited  querying  of  Section  702  acquisitions 
that  is  currently  permitted  (s^  June  1  Submission  at  23),  why  is  it  reasonable  and  appropriate  to 
broaden  the  targeting  procedures  to  permit  quer3dng  using  U.S.-person  identifiers? 


16.  The  government  acknowledges  that  it  previously  “did  not  fully  explain  all  of  the  means  by 
which . . .  communications  are  acquired  through  NSA’ s  upstream  collection  techniques”  (Jime  1 
Submission  at  2),  yet  states  that  the  “[Attorney  General]  and  [Director  of  National  Intelligence] 
have  confirmed  that  their  prior  authorizations  remain  valid”  (id,  at  35).  At  the  time  of  each 
previous  Certification  under  Section  702,  were  the  Attorney  General  and  the  Director  ofNational_ 
Intelligence  aware  that  the  acquisitions  being  approved  included  Internet  “transactions” 

I?  If  so,  why  was  the  Court  not  informed.  If  not,  why  are  the  prior _ 

Certifications  and  collections  still  valid? 
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UNITED  STATES 

FOREIGN  INTELLIGENCE  SURVEILLANCE  COUKRT'^^-’ 
WASHINGTON,  D.C.  •• 


IL-  5  \ 


NOTICE  OF  FILING  OF  GOVERNMENT'S  RESPONSE 
TO  THE  COURT'S  SUPPLEMENTAL  QUESTIONS  OF  TUNE  17, 2011 


THE  UNITED  STATES  OF  AMERICA,  through  the  undersigned  Department  of 
Justice  attorney,  respectfully  submits  the  attached  factual  and  legal  response  to  the 
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supplemental  questions  provided  by  tMs  Court  to  the  Government  on  June  17,  2011, 
conceriung  the  above-referenced  matters.  Given  the  complex  nature  of  the  Court  s 
questions  and  the  Government's  responses,  the  United  States  is  prepared  to  provide 
an}'  additional/supplemental  information  the  Court  believes  would  aid  it  in  reviewing 
these  matters.  The  Govermnent  may  also  seek  to  supplement  and/or  modify  its 
response  as  appropriate  during  an}'  hearing  that  the  Court  may  hold  in  the  above- 
captioned  matters.  -f5//OC,MFl  • 


Respectfull}'  submitted. 


National  Security  Division 
United  States  Department  of  Justice 
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VERIFICATION 

1  declare  under  penalty  of  perjury  that  the  facts  set  forth  in  the  attached. 
Government's  Response  to  the  Court's  Supplemental  Questions  of  June  17,  2011,  are 
true  and  correct  based  upon  my  best  information,  knowledge  and  belief.  Executed 
punsuant  to  Title  28,  United  Sta 


National  Seairit)'  Agency 


IS  Code,  §  1746,  on  this  28th  day  of  June,  2011.  -fS) 


Signals  Intelligence  Directorate  Compliance 
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GOVERMNIENT’S  RESPONSE  TO  THE 
COURT’S  FOLLOW-UP  QUESTIONS  OF  JUNE  17,  2011 


1.  The  government’s  Response  to  the  Court’s  Briefing  Order  of  May  9,  2011  (“June  1 
Submission”)  states  that  Internet  transactions  acquired  by  NSA  in  its  upstream  collection 
may  contain  not  only  multiple  discrete  communications  (some  of  which  arc  neither  to,  from, 
nor  about  a  tasked  selector),  but ; 


I  June  1  Submission  at  25. 


b.  What  is  the  likelihood  that  pertain  to  persons  other 

than  the  users  of  tasked  selectors,  indudin^ersonninh^nited  States  or  U.S.  persons? 


As  was  more  fully  explained  in  the  Govermnent’s  June  1  Submission,  the  presence  of  a 
tasked  selector  is  required  in  order  for  the  National  Security  Agency’s  (NSA)  upstream  Internet 
collection  devices  to  identify  and  then  acquire  Internet  communications  in  the  fonn  of 
transactions.  See  June  1  Submission  at  I,  24-26.  The  Court’s  question  in  l.a.  furthei  asks 


NSA  in  relation  to  any  one  or  more  of  these  communication  services  to  the  extent  it  is  included 
within  a  transaction.  This,  however,  is  true  even  with  respect  to  discrete  communications  to. 
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Although  personal  information  may  be  included  in  a  transaction,  the  manner  in  which 
NSA  conducts  its  upstream  collection  significantly  diminishes  the  likelihood  that  such 
mfomiation  would  pertain  to  U.S.  persons  or  persons  in  the  United  States.  As  discussed  more 
fiilly  in  the  Government’s  response  to  question  14  below,  NSA  acquires  certain  transactions 
because  tliey  contain  a  discrete  communication  to  or  from  a  tasked  selector  used  by  a  person  who, 

by  virtue  of  the  application  of  NSA’s  targetingprocedures,  is  a  nomUnited-States-person - 

reasonably  believed  to  be  located  outside  tlie  United  States.  NSA  acquires  transactions  that 
contam  a  discrete  communication  about  a  tasked  selector  using  teclmical  means  that  arc  designed 
to  ensure  tliat  such  acquisition  is  directed  at  a  person  reasonably  believed  to  be  located  outside 
the  United  States.  The  Court  has  previously  recogirized  that  “the  vast  majority  of  persons  who 
are  located  overseas  arc  non-United  States  persons  and  that  most  of  their  communications  are 
with  other,  non-United  States  persons,  who  are  located  overseas.”  In  re  Directives  to  Yahoo!, 

Inc.  Pursuant  to  Section  105B  of  the  Foreisn  Intelligence  Swveillance  Act,  Docket  No. 
105B(g):07-01,  Mem.  Op.  at  87  (USFISG  April  25,  2008)  (footnote  omitted)  (hereinafter  “In  re 
Directives  to  Yahoo!  Mem.  Op.).  Thus,  it  is  reasonable  to  presume  that  most  of  the  discrete 
communications  that  may  be  within  an  acquired  transaction  are  between  non-United  States 
persons  located  outside  the  United  States.  (TS//SI//OC/NF) 


2.  The  June  1  Submission  states  that  “no  NSA  analyst  has  yet  discovered  in  NSA’s 
repositories  a  wholly  domestic  communication,”  June  1  Submission  at  9. 

a.  What  is  meant  by  “wholly  domestic  communication”  in  this  statement?  Does  the 
term  include  the  discrete  communications  that  might  be  embedded  within  acquired 
transactions? 


By  “wholly  domestic  communication”  the  Govermnent  means  a  communication  as  to 
wliich  the  sender  and  all  intended  recipients  are  located  within  the  United  States.  The 
Government  includes  within  this  term  any  discrete  communication  within  a  transaction  where  the 
sender  and  all  intended  recipients  of  the  discrete  communication  were  located  in  the  United 
States  at  the  time  the  communication  was  acquired.  With  the  previously  described  limited 

,  NSA  analysts 

have  yet  to  identify  a  wholly  domestic  communication  m  any  transaction  acquired  through 
NSA’s  upstream  collection  systems.  -fTS//SI//NF)  -  - - 
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b.  What  is  the  likelihood  that  an  analyst  viewng  information  obtained  through  a 
transactional  acquisition  would  have  a  basis  lor  determining  that  a  discrete 
communication  embedded  within  the  transaction  is  purely  domestic? 


The  likelihood  tliat  an  NSA  analyst  would  recognize  that  a  bansaction  containing  either 


3.a.  Might  the  non-targeted  portion  of  a  transaction  ever  be  the  sole  basis  for  that 
transaction  being  responsive  to  an  analyst’s  query? 

Yes.  All  information  acquired  by  NSA  as  a  result  of  tasking  the  targeted  foreign  person  s 
selector  —  whether  initially  determined  to  be  foreign  mtelligence  information  to,  from,  or  about 
that  targeted  foreign  person  (or  foreign  intelligence  mformation  concerning  other  foreign  persons 
or  organizations)  or  incidentally  acquired  infonnation  conceiiring  other  cuiTently  non-targeted 
persons  -  can  be  queried  by  analysts  for  foreign  intelligence  information.  As  a  result,  it  is 
possible  that  any  portion  of  a  transaction  could  be  the  sole  basis  for  that  transaction  bemg 
responsive  to  an  analyst’s  foreign  intelligence  query  of  NSA  databases.  Such  queries  (wliich  are 
subject  to  review),  however,  must  be  formulated  by  an  analyst  in  accordance  with  NSA 
minimization  procedures  which  require  that  computer  selection  terms  used  for  scanning,  such  as 
telephone  numbers,  key  words  or  plnases,  or  other  discriminators,  be  limited  to  those  selection 
terms  reasonably  likely  to  return  foreign  intelligence  infonnation.  See,  e.g.,  Ameirdment  1  to 
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DNI/AG  702(g)  B,  filed  Aug.  12,  2010,  § 

3(b)(5)  (hereinafter  “Cuirent  NSAT^immizatTOi^roceau^?)^ (TS//3I//NF) — 


3.b.  Upon  retrieving  information  in  response  to  a  query,  can  an  analyst  readily  distinguish 
that  portion  of  a  transaction  that  contains  the  targeted  selector  from  other  portions  of  a 
transaction? 


Yes.  The  tasked  selector  that  resulted  in  NSA’s  acquisition  of  any  particular  transaction 
is  discemable  by  analysts  reviewing  infonnation  in  response  to  a  query.  The  analytic  tools  used 
to  display  an  acquired  transaction  allow  NSA  analysts  to  identify  the  tasked  selectors  that 
resulted  in  the  acquisition  of  the  transaction,  thereby  enabling  analysts  to  detennine  the  portion(s) 
of  the  transaction  in  wliich  that  selector  appears,  hi  some  instances,  the  analyst  may  need  to 
review  the  entirety  of  the  transaction  (including  the  underlying  metadata  or  raw  data)  to  identify 
where  the  tasked  selector  appears,  but  even  m  these  situations,  tlie  tasked  selector  is  included  and 
tiflable.  I 


M  ai.%WFAM  I  ra 


4.a.  Please  describe  the  manner  in  which  the  government  minimizes  discrete 
communications  and  other  information  that  is  contained  within  acquired  Internet 
transactions  but  that  is  neither  to,  from,  nor  about  the  user  of  a  targeted  selector, 

4.b.  In  particular,  please  explain  how  the  government  applies  the  provisions  of  NSA’s 
minimization  procedures  that  use  the  term  “communication”  to  the  discrete 
communications  and  other  non-target  information  contained  within  the  transactions  tiiat 
are  acquired.  See,  e.g.,  NSA  Minimization  Procedures  §  2(c)  (defining  “(cjoinmunications 
of  a  United  States  person”);  §  2(e)  (defining  “foreign  communication”  and  “domestic 
communicatioiifl”),  §  3(b)(4)  (discussing  determination  w'hether  a  communication  is 
“foreign”  or  “domestic”),  and  §  5  (discussing  handling  of  domestic  communications). 

4.C.  Would  all  communications^^^^^^^^^^^^^^^^^^^^Kvithin  transaction  be 
treated  the  same  when  the  minimization  procedure^r^ppnea^i^vould  there  be 
different  treatment? 


^  The  Govenunent  seeks  the  Court’s  approval  of  revised  NSA  Section  702  minimization  procedures  that  would 
enable  NSA  analysts  to  use  United  States  person  identifiers  as  selection  terms  if  those  selection  tenns  are  reasonably 
likel^^^rn  foreign  intelligence  information.  See,  e.g.,  DNI/AG  702(g)  Certification^^mM|M|^M 

Ex.  B,  filed  Apr.  20,  201 1,  §  3(b)(5)  (hereinafter  “Proposed  NSA  Minimizat^^^^W^^^^^mder 
these  revised  NSA  Section  702  minimization  procedures,  the  use  of  such  selection  tenns  must  be  approved  in 
accordance  with  NSA  procedures  designed  to  ensure  that  the  selection  tenns  are  reasonably  likely  to  return  foreign 
intelligence  infomiation.  /rf.  The  Govenunent  is  still  in  the  process  of  developing  the  NSA  procedures  governing 
the  use  of  United  Stales  person  identifiers  as  selection  terms.  Until  those  procedures  are  completed,  NSA  analysts  _ 
will  not  begin  using  United  States  person  identifiers  as  selection  terms.  (TS//SI//NF) 
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As  required  by  FISA,  see  50  U.S.C.  §§  1881a(e),  1801(h),  and  1821(h),  NSA’s 
minimization  procedures  address  the  acquisition,  retention,  and  dissemination  of  non-publicly 
available  infoirnation  concerning  unconseuting  United  States  persons.  See  Current  Minimization 
Procedures,  §  1 Wlien  NSA  acquires  an  Internet  transaction  that  contains  multiple  discrete 
communications,  NSA  considers  each  of  those  communications  to  be  separate 
“communications”  under  its  minimization  procedures.  Thus,  for  example,  an  NSA  analyst 
would  consider  each  discrete  communication  within  a  larger  Internet  transaction  as  a  separate 
conununication.  for  puiposes  of  determining  whether  the  cormnunication  is  a  foreign  or  domestic 
communication  under  NSA’s  minunization  procedures.  See,  e.g.,  Current  and  Proposed  NSA 
Minimization  Procedures,  §  2(e).  ■(TS//SI//0C/>»1F) — 

The  mamier  in  which  acquisitions  are  conducted  under  Section  702  operates  to  minimize 
the  acquisition  of  infonnation  about  United  States  persons.  First,  certain  transactions  are 
acquired  because  they  contain  a  discrete  conununication  to  or  from  a  tasked  selector  used  by  a 
person  who,  by  virtue  of  the  application  of  NSA’s  FISC-approved  targeting  procedures,  is  a  non- 
United  States  person  reasonably  believed  to  be  locatedrontside  the  United'S-tatesr-This-GourHias- 
recognized  that  “the  vast  majority  of  persons  who  are  located  overseas  are  non-United  States 
persons  and  that  most  of  their  coimuuni cations  are  with  other,  non-United  States  persons,  who 
are  located  overseas.”  In  re  Directives  to  Yahoo!  Mem.  Op.  at  87  (footnote  omitted). 
Accordingly,  it  is  reasonable  to  presume  that  most  of  the  discrete  communications  that  may  be 
within  the  acquired  transaction  —  even  those  that  are  not  to  or  from  a  tasked  selector  —  are 
between  non-United  States  persons  located  outside  the  United  States.  Second,  with  respect  to 
transactions  that  contain  a  discrete  communication  about  a  tasked  selector,  the  teclmical  means 
by  which  NSA  prevents  the  intentional  acquisition  of  wholly  domestic  communications  are 
designed  to  ensure  that  the  acquisition  of  transactions  is  directed  at  persons  reasonably  believed 
to  be  located  outside  the  United  States.  As  a  result,  these  persons  reasonably  also  can  be 
presumed  to  be  non-United  States  persons,  and  most  of  their  communications  —  including  those 
that  are  not  about  a  tasked  selector  —  can  be  presumed  to  be  with  other  non-United  States 
persons  located  outside  the  United  States.  Id.  This  combination  of  targeting  non-United  States 
persons  located  outside  the  United  States  and  directing  acquisitions  at  persons  located  outside  the 
United  States  operates  to  significantly  dimim’sh  the  amount  of  information  pertaining  to  United 
Stateyre^ns  or  persons  in  the  United  States  that  NSA  acquires  tlu'ough  its  upstream  collection. 
^eeH^^^Mem.  Op.  at  23  (recognizing  that  “[t]he  targeting  of  communications  pursuant  to 
Section  702  is  designed  in  a  maimer  that  diminishes  the  likelihood  that  U.S.  person  infonnation 
will  be  obtained”).  (TS//GI//OC/>'fF)' ■  - 

To  be  sure,  it  is  possible  that  a  ti'ansaction  containing  multiple  discrete  communications 
only  one  of  wliich  is  to,  from,  or  about  a  tasked  selector  could  contain  U.S.  person  infoimation, 
The  acquisition  of  such  information  is  an  unavoidable  by-product  of  the  acquisition  of  the 
foreign  intelligence  infonnation  (i.e.,  the  communication  to,  from,  or  about  a  tasked  selector) 
within  the  transaction.  Yet  it  is  important  to  note  that,  for  puiposes  of  the  application  of  NSA’s 
current  and  proposed  minimization  procedures,  the  Govermnent  does  not  consider  its  acquisition 

NSA’s  proposed  mimmizatioii  procedures  cuiTently  before  the  Court  address  these  same  issues.  See  Proposed 
NSA  Minimization  Procedures  §  I .  {Sy- 
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of  a  discrete  coinmimication  witliiii  a  transaction  that  is  not  to,  fi'om,  or  about  a  tasked  selector  to 
be  “inadvertent.”  Subsection  3(b)(1)  of  NSA’s  cuirent  and  proposed  minimization  procedures 
require  inadvei-tently  acquired  communications  to  be  destroyed  if  they  are  “identified  either:  as 
clearly  not  relevant  to  the  authorized  purpose  of  the  acquisition  (e.g.,  the  communication  does 
not  contain  foreign  intelligence  information);  or  as  not  containing  evidence  of  a  crime  wliich 
may  not  be  disseminated  under  these  procedures.”  Cuixent  and  Proposed  NSA  Minimization 
Procedures,  §  3(b)(1).  ■■(TS//SMjF)- 

As  described  below  in  the  Government’s  response  to  question  10,  tlie  Government 
considers  a  discrete  conununication  that  is  not  to,  from,  or  about  a  tasked  selector  within  a 
ti'ansaction  to  be  acquired  “incidentally,”  rather  than  “inadvertently.”  In  the  context  of 
minimization,  “incidental”  and  “inadvertent”  should  not  be  considered  synonymous.  Given  that 
the  acquisition  of  the  transaction  is  intentional,  and  given  tlie  Govenunent’s  knowledge  that  such 
transactions  may  also  include  information  that  is  not  to,  from,  or  about  a  tasked  selector,  the 
acquisition  of  this  additional  infonnation  is  not  “inadvertent.”  By  contrast,  the  additionally 

acquired  infonnation  is  “incidental’nn  that  it  is  not  the  basisTortbexorHection-buHs-Tatl’ieF-a - 

necessary  yet  unavoidable  consequence  of  acquiring  foreign  communications  to,  from,  or  about  a 
tasked  selector.  Mem.  Op.  at  40  (concluding  that  tire  Government’s  minimization 

procedures  “constitute  a  safeguard  against  improper  use  of  information  about  U.S.  persons  that  is 
inadvertently  or  incidentally  acquired”)  (emphasis  added). ^  Otherwise,  subsection  3(b)(1)  of 
NSA’s  current  and  proposed  minimization  procedures  would  require  the  destruction  of  the  entire 
transaction  -  even  the  very  foreign  intelligence  information  that  resulted  in  the  transaction’s 
acquisition  in  the  first  place  —  if  any  discrete  communication  therein  contained  United  States 
person  infonnation  and  was  not  to,  from,  or  about  a  tasked  selector.  (TS//SLVQQ1vfF)r 

Such  an  absurd  result  simply  cannot  be  squared  witli  Congress’s  explicit  intent  that  non¬ 
pertinent  infonnation  should  be  destroyed  only  if  “feasible.”  See  H.R.  Rep.  No.  95-1283,  pt.  1, 
at  56  (“By  minimizing  retention,  the  committee  intends  that  infoimation  acquired,  which  is  not 
necessary  for  obtaining[,]  producing,  or  disseminating  foreign  intelligence  infonnation,  be 
destroyed  where  feasible”  (emphasis  added)).  Congi'ess  recognized  that  in  some  cases,  pertinent 
and  non-pertinent  infonnation  may  be  co-mingled  in  such  a  way  as  to  make  it  teclmologically 
infeasible  to  segi'egate  the  pertinent  infonnation  from  the  non-pertinent  information  and  then 

^  The  Government  notes  that  at  a  single  point  in  its  June  1  Submission,  it  incorrectly  described  the  acquisition  of  a 
discrete  communication  that  is  not  to,  from,  or  about  a  tasked  selector  within  a  transaction  to  be  acquired 
“inadvertently.”  See  June  1  Submission  at  13  (“The  issue  for  the  Coint  in  light  of  the  above-described  nature  and 
scope  of  NSA’s  upstream  collection  is  whether,  in  light  of  a  governmental  interest  ‘of  the  highest  order  of 
magnitude,’  NSA’s  targeting  and  minimization  procedures  sufficiently  protect  the  individual  privacy  interests  of 
United  States  persons  whose  communications  are  inadvertently  acquired.”).  However,  the  Government  otherwise 
consistently  described  the  acquisition  of  such  communications  as  “incidental,”  see,  e.g.,  id.  at  15  (“NSA’s  upstream 
collection  may  incidentally  acquire  information  conceniing  United  States  persons  witliin  transactions  containing 
multiple  discrete  communications,  only  one  of  which  is  to,  from,  or  about  a  person  targeted  under  Section  702.”);  id. 
at  19  (“The  fact  that  other,  non-pertinent  information  within  the  transaction  may  also  be  incidentally  and 
unavoidably  acquired  simply  caiuiot  render  the  acquisition  of  the  transaction  uimeasouable.”);  id.  (“[T]o  the  extent 
that  United  States  person  infonnation  is  incidentally  acquired  in  the  acquisition  of  a  whole  fransaction  by  NSA’s 
upstream  collection,  such  information  will  be  handled  in  accordance  with  strict  minimization  procedures.”). 
(TS//SI//MF) - 
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desti'oy  the  latter.  See  id.  (“The  committee  recognizes  that  it  may  not  be  feasible  to  cut  and  paste 
files  or  erase  part  of  tapes  where  some  infoimation  is  relevant  and  some  is  not.”).  Here,  it  is  not 
technologically  feasible  for  NSA  to  extract,  post-acquisition,  only  the  discrete  communication 
that  is  to,  from,  or  about  a  tasked  selector  within  a  transaction.  Thus,  in  order  for  NSA  to  retain 
the  foreign  intelligence  information  within  a  transaction,  it  must  retain  the  entire  transaction, 
including  anj'  incidentally  acquired  infoimation  about  U.S.  persons  or  persons  in  the  United 
States  contained  therein.  (TSA^SI//>jF)~ 

This  incidentally  acquired  infonnation  in  transactions  is  subjected  to  the  same  restrictions 
on  use  and  dissemination  that  govern  information  obtained  thi'ough  other  means  pursuant  to 
Section  702  (such  as  through  collection  at  Internet  Service  Providers).^  The  Court  has 
previously  found  these  restrictions  on  use  and  dissemination  in  NSA’s  cuirent  minimization 
procedures  to  be  consistent  with  the  Act  and  the  Fourth  Amendment.  See,  e.g,  In  re  DNI/AG 

8-12  (USFISC^^HIB  2010);  In 

re  DNI/AG  Mem.  Op.  at 

2009).  Of  course,  the  Government  scel^he~CoTirtVappro~val  of  revised-NSA-Sectien-vu^^^™ 
minimization  procedures  that  would  enable  NSA  analysts  to  use  United  States  person  identifiers 
as  selection  terms  if  those  selection  tenns  are  reasonably  likely  to  return  foreign  intelligence 
information.  As  discussed  in  its  response  to  question  14  below,  the  Government  respectflilly 
suggests  that  these  revised  NSA  minimization  procedures  are  also  consistent  with  the  Act  and  the 
Fourth  Amendment.  -(TS/ZSI/ZOG^IF) - 

hi  sum,  NSA  treats  each  discrete  communication  contained  within  a  larger  Internet 
transaction  as  a  separate  communication  for  purposes  of  its  minimization  procedures.  Although 
it  is  possible  that  certain  discrete  communications  containing  United  States  person  information 
will  be  retained,  as  described  above,  they  remain  subject  to  the  same  restrictions  on  use  and 
dissemination  imposed  by  NSA’s  minimization  procedures.  (TS//SI//OC/NF) — 


5. a.  Once  NSA  has  identified  a  portion  of  a  transaction  that  does  not  contain  targeted 
information,  is  it  possible  to  mask  or  otherwise  minimize  the  non-target  information 
contained  within  the  transaction? 

No.  The  analytic  tools  used  to  display  (he  acquired  data  to  NSA  analysts  do  not  have  a 
capability  to  mask  infonnation  or  othenvise  minimize  the  non-target  information  contained 
within  a  transaction.  See  additional  details  provided  in  re.sponse  to  question  6  below. 
(TG//GI//Nr)  - 


®  Moreover,  as  discussed  in  response  to  question  3.b.  above,  NSA’s  inability  to  separate  tlic  discrete 
communications  post-acquisition  also  means  that  the  discrete  communications  are  not  displayed  in  NSA’s  SC-SSRs 

as  separate  communications,  but  rather  clearly  retain  their  connection  to  the  entirety  of  the  original  transaction, _ 

making  it  more  apparent  to  NSA  analysts  the  discrete  communication’s  relationship  to  a  tasked  selector. 
{TS//SI//OC/MF) 
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S.b.  Why  is  NSA  unable  to  delete  and  replace,  or  alter,  an  original  transaction  that  contains 
non-target  information?  See  June  1  Submission  at  27-28. 

The  answer  to  this  question  is  included  in  tlie  response  to  question  6  below.  (TS//SI/i^>ff)- 


6.  The  government  states  that  an  Internet  transaction  that  is  acquired  “is...  not  divisible 
into  the  discrete  communications  within  it  even  once  it  resides  in  an  NSA  corporate  store.” 
June  1  Submission  at  22.  Please  reconcile  that  statement  with  the  government’s 
acknowledgment  that  “an  analyst  would  ...  be  able  to  copy  a  portion  of  the  rendered  view 
of  a  transaction  contained  in  a  NSA  corporate  store  and  then  paste  it  into  a  new  record  on 
a  different  system.”  at  27  n.25. 


As  discussed  in  the  example  of^minformation  on  pages  27-28  of  the  June  1 
Submissioi^he  data  witliin  such  transactions  is  organized  in  a  fasliion  meant  to  be  displayed 
using  fonnabm-whieh- 

discrete  communications  thatma>nD^omame^witnin  the  transaction  are  distinguishable,  hi 
order  for  NSA  to  identify  and  separate  a  hansaction  containing  multiple  communications  into 
those  component  parts,  the  transaction  would  require  processing,  parsing,  and  reformatting  for 
those  components  intended  for  subsequent  retention  as  separate  communications.  This  is  tine  at 
the  point  of  acquisition  and  at  any  point  post-acquisition,  including  at  the  point  of  display  to  the 
analyst,  whether  the  mtent  is  to  separate  out  a  particular  conununication  fi’om  the  transaction  for 
lumose  of  deleting  it,  replacing  it,  masking  it,  or  othei-wise  altering  it. 


Absent  ^^^^^Biapabilities  as  discussed  above,  attempts  by  NSA  analysts  to  delete, 
replace  or  otherwise  alter  (e.g.,  mask  or  otherwise  minimize  the  non-target  infoimation  contained 
witliin  the  transaction)  a  portion  of  a  transaction  intercepted  thi'ough  NSA’s  upstream  collection 
tecluiiques  could  similarly  corrupt  the  integrity  of  the  collection,  destabilizing  -  and  potentially 
rendering  unusable  -  some  or  all  of  tlie  collected  transaction,  including  any  particular 
communication  therein  for  anal)dic  or  other  purposes.  Maintaining  the  integiity  of  original 
transactions  is  paramount  to  NSA’s  retention  and  dissemination  processes.  Specifically,  NSA 
has  developed  and  implemented  a  comprehensive  purge  process  designed  to  improve  the 
completeness  of  data  purges.  The  efficacy  of  tliis  process  depends  in  large  measure  on  NSA’s 
ability  to  trace  data  back  to  the  original  object  (such  as  a  transaction)  in  a  SIGfNT  Collection  - 
Source  Systems  of  Record  (SC-SSR).  Maintaining  the  integrity  of  original  hansactious  is  also 
important  for  ensuring  quality  control  of  NSA’s  foreign  intelligence  analysis  of  Intcmet 
cormnunications,  wliich  frequently  may  contain  more  tlian  one  tasked  selector  or  could  be  used 
by  more  tlian  one  analyst,  depending  on  the  target,  mission,  or  specific  foreign  intelligence  need 
to  which  it  pertains.  Thus,  preseiving  the  integiity  of  the  data  is  dependent  upon  the  retention  of 
the  original  transactiohlh  its  original  forrh  as  stored  in  the  SC-SSR.  (TS//SI//OC/NF) 


TOP  SECRET//COiVnNT//ORCON/NOFORN 

8 


NYT  V  DOJ,  16  CIV  7020_000421 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1027  of  1298 

Approved  for  public  release.  All  withheld  information  exempt  under  b(1)  and  b(3)  except  as  otherwise  noted. 

TOP  SECRET//CONUNT//ORCON/NOFORN- 


The  govenmient's  representation  that  an  Internet  transaction  that  is  acquired  is...  not 
divisible  into  the  discrete  communications  within  it  even  once  it  resides  in  an  NSA  co^|te 
store”  was  intended  to  convey  that  it  is  not  technologically  feasible  for  NSA  to  create^^^l 
processes  to  divide  transactions  mto  discrete  communications.  Footnote  25  on  page  27  of  the 
June  1  Submission  refers  to  the  fact  that  it  is  possible  for  individual  analysts  to  copy  some  of  the 
information  from  a  transaction  in  NSA  corporate  stores  into  a  new  document  or  file  stored  on  a 

ri  _  .  'TN'KTT/  a  n  rr^ 


separate  system,  such  as  a| 
discussion  of  | 


_ See,  e.g.,  DNI/AG  702(g)  Certification 

Trans,  of  Proceedings  at  20-21  (j^m^OlO)  (for  a 
uibuuooiuii  uj.  ^  co^^^^^ffact  can  be  made, 

however,  does  not  mean  that  the  underling  transaction  can  then  be  altered  in  the  cOTi^^^^e. 
For  example,  if  an  analyst  copied  a  portion  of  a  transaction  fi-om  an  SC-SSR  into  a 
^^^^^^~~^and  then  purged  the  transaction  from  the  SC-SSR,  the  data  copied  into  the 

would  likeAvise  have  to  be  purged  —  even  if  it  contained  foreign 
intelligence  information  copied  fi-om  a  communication  to,  from,  or  about  a  tasked  selertm-^-^^ 
because  it  could  no  longer  be  traced  back  to  an  object  present  m  an  SC-SSR.  (TS//SI//QC,dv|.F)- 


7.  Please  reconcile  the  govei'ninent’s  statement  that  the  “communicants”  of  to/fiom 
communications  are  “the  individual  users  of  particular  selectors”  (see  June  1  Submission  at 

its  response  to  the  Court’s  questions  (seei_e^,  id.  at  b  (discussing  appncaiiou  o 
filtering)). 

^vemmenr^escriptioiraniow 
Jto  detennine  if  one  end  of  a 
mi  page  30  of  the  June  1 

lU/liUlll  UUimilUJLJJ.s^avivjJ.i  jio  - -  -  r  o 

Submission,  the  communicants  in  to/from  communications  are  the 
senders  and  intended  recipients  of  those  communications,  rather 


The  Government  believes  its  statement 
the  case(^  to/from  communications  is  fully  consistent  with  the 

NSA _ ^ ' 

to/fi-om  conununicatiou  is  outside  of  the  United  States.  As  state 


As  described  in  the  June  1  Submission,  there  are  scenarios  under  wliich  NSA  could 
unknowingly  and  unintentionally  acquire  a  to/froin  communication  in  which  the  sender  and  all 
intended  recipients  are  in  the  United  States  at  the  time  of  acquisition  -  for  example,  if  that 
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^  unlikely  event  that  NSA 

does  unintentionally  acquire  such  a  coirununication,  NSA  will  purge  the  communication  unless 
its  continued  retention  is  authorized  by  the  Attorney  General  in  accordance  with  50  U.S.C. 

§  1806(i).  If  the  communication  is  itself  contained  within  a  transaction  that  contauis  other 
discrete  cormnunications,  the  whole  transaction  will  be  purged  unless  its  continued  retention  is 
authorized  by  the  Attorney  General  m  accordance  with  50  U.S.C.  §  18060^regardless  of 
whether  those  other  discrete  connnuirications  are  foreign.  ■(TS//SI//OGT''JF)" 


lat  is  the  factual  basis  for  NSA’s  assertions  that  “a  United  States  person  would 
in  a  minute  percentage  of  cases”  and  that  ] 

See  June  1  Submission  at 


These  factual  assertions  by  NSA  are  based  upoiniie^sessuicuts  ofNSA  Signals- 
hitelligence  (SIGINT)  persomrel,  who  have  been  involved  in  NSA’s  Section  702  acquisitions 

Gnitiatioi^^ha^ollection^n^nani^^whonGimf^m^mienc^ 

fectua^ssertionniUh^un^^ubiniSonral^Is^aseKinSeweM^^^ampling  of  Section 
702-acquired  communications,  wlrich  is  described  on  page  9  of  the  June  1  Submission.  As  is 
more  fully  discussed  in  that  filing,  NSA’s  review  of  ||^  recordsbetweenthese^ 

i^nbJHrecordsindicativ^  a non-targete^i^H^^m|^|^HmHP|||l 

in  the  United  States.  Furtnemesearcmreveale^nannes? 
^^^ecorf^wer^ctaaU^opie^l^he  same  transaction,  and  NSA  found  no  indication  that  any 
wholly  domestic  communications  were  within  this  transaction.  NSA  assesses  that  the  lesults  of 
these  tests  are  consistent  with  the  assessments  made  by  NSA’s  SIGINT  personnel  in  the  June  1 
Submission.  (TS//SI//0 CZ/NF)- 


'  described,  it  would  be  very  unlikely  for 
^ill  wliich  the  sender  and  all  intended  recipient^rHocaiet 
Submission  at  11.  Moreover,  with  the  previously  described  limited  exceptioj 


'June  1 


see  id.  at  6  &  n.5,  NSA  analysts  have  yet 
communication  acquired  through  NSA’s  upstream  collection  systems.  See  id  at  9  (noting  NSA’s  experience  to  date 
ling  NSA’s  test  samples,  stating  that  the  only  records  possibly  indicative  of  a  United  Slatcs-based  user  _ 
did  not  reveal  that  any  wholly  domestic  communications  had  been  acquired). 

iTsm/zeeNF) — 

TOP  SECRET//COMINT//ORCON/NOFORN 
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10.  The  government  repeatedly  characterizes  as  “unintentional”  NSA  s  collection  of 
discrete  non-target  communications  as  part  of  transactional  acquisitions,^ — ^  ^ 

Assuming  arguendo  that  such  collection  can  fairly  be  characterized  as 
unintentional,  please  explain  how  50  U.S.C.  §  1806(i)  applies  to  the  discrete,  wholly 
domestic  communications  that  might  be  contained  within  a  particular  transaction. 


Subsection  1 806(i)  provides  that  “[i]n  circumstances  involvmg  the  unintentional 
acquisition  by  an  electronic,  mechanical,  or  other  sui-veillance  device  of  the  contents  of  any 
coLiunication,®  under  circumstances  in  wliich  a  person  has  a  reasonable  expectation  of  privacy 
and  a  waixant  would  be  requhed  for  law  enforcement  purposes,  and  if  both  the  sendei  an  a 
intended  recipients  are  located  in  the  United  States,  such  contents  shall  be  destroyed  upon 
recognition,  unless  the  Attorney  General  detcnnines  that  the  contents  indicates  a  tlireat  of  dea 

or  serious  bodily  hami  to  any  person.”  (U) 

The  Government’s  June  1  Submission  described  for  the  Court  that  at  the  time  of 
acquisition,  NS A’s  Section  702  upstream  hrternet  collection  devices  are  genera^  not  capable  of 
distinguishing  transactions  contaming  only  a  single  discrete  commumcation  to,  from  or  about  a 
tasked  selector  from  transactions  containmg  multiple  discrete  communications,  not  all  of  w 


«  Subsection  180'6(i)  originally  covered  only  radio  communications. 

communications  to  make  it  technology  neutral,  154  Cong.  Rec.  S61 33  (daily  ed.  June  25, 2008).  (U) 
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may  be  to,  from,  or  about  a  tasked  selector  at  the  time  of  acquisition.^  See  June  1  Submission  at 
7,  27-28.  The  Government  considers  the  acquisition  of  communications  witliin  a  transaction  that 
are  not  to,  from,  or  about  a  taisked  selector  to  be  incidentally  acquired  communications. 

However,  the  Govermnent  does  not  intend  to  acquire  transactions  containing  communications 

be 


acquiring  Internet  transactions  contaming  multiple  discrete  coimnunications,  hot  all  of  which 
may  be  to,  from,  or  about  a  tasked  selector,  the  Government  recognizes  that  subsection  1 806(i) 
could  potentially  be  implicated  to  the  extent  that  one  of  those  discrete  communications  is  a 
conmiunication  in  which  the  sender  and  all  intended  recipients  were  located  in  the  United  States 
at  the  time  of  acquisition.  Accordingly,  in  the  event  NSA  recognizes  a  wholly  domestic 

communication  wliich  is  not  to,  from,  or  cfbout  a  tasked ■selectorTvhiclrit-has-inuHtentioHally - 

acqufred  in  the  course  of  conducting  its  Section  702  upstream  Internet  collection,  NSA  would 
handle  the  entire  transaction  in  accordance  with  subsection  1806(i)  and  either  purge  it  or,  if 
appropriate,  seek  authorization  from  the  Attorney  General  to  retain  it.  'tT3//5I//OC/NF)- 

NSA’s  minimization  procedures,  adopted  by  the  Attorney  General  in  consultation  with 
the  Director  of  National  Intelligence,  allow  the  Director  of  NSA  to  execute  a  waiver  permitting 
tire  retention  of  wholly  domestic  communications.  See  Current  and  Proposed  NSA  Minimization 
Procedures,  §  5.  However,  this  provision  applies  to  the  acquisition  of  domestic  communications 
when  the  Govermnent  has  a  reasonable,  but  mistaken,  belief  that  the  target  is  a  non-United  States 
person  located  outside  the  United  States  because  NSA  is  intentionally  but  mistakenly  acquiring 
such  conmiunications.’®  This  domestic  conununications  carve-out  does  not  apply  to  an 
unintentionally  acqufred  transaction  that  contains  a  wholly  domestic  cormnunication  (when 
recogifrzed  as  such  by  NSA)  along  with  other  discrete  communications,  which  is  not  to,  fi'om,  or 
about  a  tasked  selector.  As  described  previously,  NSA’s  Section  702  upsfream  Internet 
collection  devices  are  generally  incapable  of  distinguishing  transactions  containing  only  a  suigle 
discrete  coimnunication  to,  from,  or  about  a  tasked  selector  from  transactions  containing  multiple 
discrete  communications,  not  aU  of  which  may  be  to,  from,  or  about  a  tasked  selector  at  the  time 
of  acquisition;  moreover,  NSA  cannot  separate  transactions  containing  multiple  discrete 
communications  into  logical  constituent  parts  post-acquisition.  Thus,  in  the  event  that  NSA’s 
Section  702  upstream  Internet  collection  resulted  in  the  unintentional  acquisition  of  a  transaction 
containing  a  wholly  domestic  coimnunication,  consistent  with  subsection  1806(i),  NSA  would 
purge  the  entire  transaction,  unless  the  Attorney  General  has  authorized  its  retention  after  first 


’  NSA  additionally  advised  the  Court  that  except  in  certain  limited  circumstances,  NSA  cannot  separate  transactions 
into  logical  constituent  parts  post-acquisition  either  without  rendering  the  transaction  unusable  for  analytic  or  other 
purposes.  See  June  1  Submission  at  27  &  n.27.  (TS//SI//OC/NF) 

See  Government’s  Analysis  of  Section  ]806(i),  DNI/AG  702(g)  CertiJication^^^^j7ocket  No.  702(i)-08-01, 
filed  Aug.  28,  2008;  ^^^Mem.  Op.  at  25-27.  (TG//Dl//OC/J^ - 
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acquisition  of  such  transactions. 
involving  the  j 
lircumvented  i 


means  to  prevent  the 
as  was  the  case 

■,or 


nevertheless  not  mtending  to  acquire  who 


,  in  the  context  o 
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detemiiiiing  that  its  contents  indicated  a  tlu'eat  of  death  or  serious  hodily  harm  to  any  person.” 
(TS//SI//QC/hff=^ 

11.  Please  provide  a  thorough  legal  analysis  supporting  your  view  that  the  knowing  and 
intentional  acquisition  of  large  volumes  of  Internet  transactions  containing  discrete 
communications  that  are  neither  to,  from,  nor  about  a  targeted  selector  (as  well  as  other 
information  not  pertaining  to  the  users  of  targeted  selectors)  is  merely  “incidental”  to  the 
authorized  purpose  of  the  collection  as  a  whole,  and  therefore  reasonable  under  the  Fourth 
Amendment. 

Fourth  Amendment  reasonableness  is  concerned  only  with  the  effect  on  Fourth 
Amendment  protected  interests,  Thus,  in  evaluating  reasonableness  under  the  Fourth 
Amendment,  the  relevant  issue  for  the  Court  in  considering  tlie  acquisition  of  communications 
incidental  to  the  purpose  of  this  collection  is  the  extent  to  which  such  incidental  conunujiications 
involve  UnitecTStates  persons  or  persons  located~iirtlie'tjnrte{hStates.  ty->m>-Megh-Qp7-at— 
37-38  (recognizing  that  non-U.S.  persons  outside  the  United  States  “are  no^ro^ted  by  the 
Fourth  Amendment”  (citing  United  States  v.  Verdugo-Urqidez,  494  U.S.  259,  274-75  (1990)). 

For  the  reasons  more  particularly  explained  in  the  Government’s  responses  to  question  1  above 
and  question  14  below,  most  of  the  coimnunications  incidentally  acquired  pursuant  to  tliis 
collection  have  no  effect  on  any  Fourth  Amendment  protected  interests.  The  Government 
acknowledges  tliat  it  is  possible  that  a  transaction  containing  multiple  discrete  conununications 
only  one  of  W'liich  is  to,  from,  or  about  a  tasked  selector  could  contain  information  pertaining  to 
United  States  persons  or  persons  located  in  the  United  States.  That,  however,  does  not  mean  that 
the  acquisition  of  multiple  discrete  communications  is  any  more  likely  to  result  in  the  acquisition 
of  United  States  person  infoimation  than  in  the  collection  of  single,  discrete  communications  to, 
from,  or  about  a  non-United  States  person  located  outside  the  United  States.  This  is  particularly 
true  because  the  technology  NSA  uses  to  prevent  the  acquisition  of  wholly  domestic 
communications  also  acts  to  limit  the  acquisition  of  coimnunications  among  and  between  United 
States  persons.'^  (TS//SL70C/NF) 


"  See  also  the  Government’s  response  to  question  7  above,  which  explains  that  there  are  other  scenarios  under 
which  NSA  could  unknowingly  and  unintentionally  acquire  a  wholly  domestic  communication.  In  the  unlikely 
event  that  NSA  does  unintentionally  acquire  such  a  communication,  NSA  will  purge  the  conunuuication  upon 
recognition  unless  its  continued  retention  is  authorized  by  the  Attorney  Genera!  in  accordance  with  subsection 
1 806(i).  If  the  communication  is  itself  contained  within  a  transaction  that  contains  other  discrete  communications, 
the  whole  transaction  will  be  purged  unless  its  continued  retention  is  authorized  by  the  Attorney  General  in 
accordance  with  subsection  1 806(i),  regardless  of  whether  those  other  discrete  communications  are  foreign. 
(TS//Sy/OG/NF) 
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Moreover,  even  with  respect  to  those  instances  in  which  U.S.  person  information  is 
acquired,  courts  in  both  the  FISA  and  criminal  (Title  III)  contexts  have  recognized  that  the 
acquisition  of  communications  incidental  to  the  purpose  of  a  collection  may  be  necessary  to 
achieve  the  goal  of  a  search  or  surveillance,  as  well  as  reasonable  under  the  Fourth  Amendment. 
See,  e.g.,  In  re  Directives  Pursuant  to  Section  105B  of  the  Foreign  Intelligence  Sun>eillance  Act, 
551  F.3d  1004,  1015  (Foreign  Int.  Suiw.  Ct.  Rev.  2008)  (hereinafter  “In  re  Directives”)  (“It  is 
settled  beyond  peradventure  that  incidental  collections  occumng  as  a  result  of  constitutionally 
pennissible  acquisitions  do  not  render  those  acquisitions  unlawful.”)  (citations  omitted));  United 
States  V.  Bin  Laden,  126  F.  Supp.  2d  264,  280  (S.D.N.Y.  2000),  ajf‘d  sub  nom.  In  re  Terrorist 
Bombings  of  U.S.  Embas.nes  in  East  Afi-ica,  552  F.3d  157  (2d  Cir.  2008),  cert,  denied  sub  nom. 
El-Hage  v.  United  States,  1 30  S.Ct.  1050  (2010)  (“[IJncidental  mterception  of  a  person’s 
conversations  during  an  otherwise  lawful  [Title  III]  surveillance  is  not  violative  of  tlie  Fourth 
Amendment.”).- (■TS//0iy/OC/fJr) 

_ In  cases  where  NSA  acquires  Internet  transactions  that  include  multiple  discrete 

connnunications,  the  Goveijunent  considers  any  discrete  communteatiDiismot  to,  frotnror-abeut — 
the  tasked  selector  to  be  incidentally  acquired.  Specifically,  the  Govenunent’s  puipose  in 
acquiring  such  a  transaction  is  to  acquire  the  foreign  intelligence  information  likely  contained 
within  the  discrete  communication  to,  from,  or  about  a  tasked  selector.  However,  because  it  is 
teclmologically  infeasible  for  NSA’s  upstream  collection  systems  to  extract  only  the  discrete 
communication  that  is  to,  from,  or  about  a  tasked  selector,  the  only  way  to  obtain  the  foreign 
intelligence  information  in  that  discrete  communication  is  to  acquire  the  entire  transaction.  Thus, 
the  acquisition  of  the  otlier  discrete  coimnunications  within  the  transaction  is  properly  considered 
“incidental,”  because  it  is  a  necessary  but  unavoidable  consequence  of  acliieving  the 
Govenunent’s  goal  of  acquiiiirg  the  foreign  intelligence  infonnation  contained  witliin  the 
discrete  communication  to,  fi'om,  or  about  a  tasked  selector.  See  H.R.  Rep.  No.  95-1283,  pt.  1,  at 
55  (1978)  (noting  that  “in  many  cases  it  may  not  be  possible  for  technical  reasons  to  avoid 
acquiring  all  infonnation”  when  conducting  foreign  intelligence  siuveillance);  see  also  id.  at  56 
(“[I]t  may  not  be  possible  or  reasonable  to  avoid  acquirmg  all  conversations.”);  cf.  United  States 
V.  McKinnon,  721  F.2d  19,  23  (1st  Cir.  1983)  (“Evidence  of  crimes  other  than  those  authorized  in 
a  [Title  III]  wiretap  wanant  are  intercepted  ‘incidentally’  when  they  are  the  by-product  of  a  bona 
fide  investigation  of  crimes  specified  in  a  valid  warrant.”).  -fFS/ZSI/ZOC/NF) 

That  is  not  to  say,  however,  that  the  acquisition  of  non-pertinent  information  is 
reasonable  in  all  cases  simply  because  the  collection  of  that  iufolmation  is  “incidental”  to  the 
piupose  of  the  searcli.  United  States  v.  Ulrich,  228  Fed.  Appx.  248.,  252  (4th  Cir.  2002)  (noting 
that  “fishing  expeditions”  or  “a  random  exploratoiy  search  or  intrusion”  violate  the  Fourtlr 
Amendment)  (quotation  marks  omitted).  Here,  NSA’s  acquisition  of  transactions  is  conducted  in 
accordance  with  FISC-approved  targeting  procedures  reasonably  designed  to  ensure  that  the 
acquisitions  are  directed  “toward  communications  that  are  likely  to  yield  the  foreign  intelligence 
infonnation  sought,  and  thereby  afford  a  degree  of  particularity  that  is  reasonable  under  the 
Fourth  Amendment.”  ^|^|Mem.  Op.  at  39-40  (footnote  omitted).  The  fact  that  such 
transactions  may  contain  non-pertinent  information  —  even  in  significant  amounts  —  does  not  by 
itself  render  the  acquisition  of  those  fransactions  umeasonable  under  the  Fourth  Amendment. 

See  Scott  v.  United  States,  436  U.S.  128,  140  (1978)  (recognizing  that  “there  are  surely  cases, 
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such  as  the  one  at  bar  [involving  a  Title  III  wiretap],  where  the  percentage  of  nonpertinent  calls 
is  relatively  high  and  yet  their  interception  was  still  reasonable”);  Abraham  v.  County  of 
Greenville,  237  F.3d  386,  391  (4th  Cir.  2001)  (“[IJncidental  overhearing  is  endemic  to 
suiweillance.”);  United  States  v.  Doolittle,  507  F.2d  1368,  1372  (5th  Cir.  1975)  (“There  is  no 
question  that  some  in’elevaut  and  personal  portions  of  gambling  conversations  were  intercepted 
or  that  certain  nonpertinent  conversations  were  intercepted.  But  tliis  is  inherent  in  the  type  of 
interception  authorized  by  Title  III,  and  we  do  not  view  the  simple  inclusion  of  such 
conversations,  without  more,  as  vitiating  an  otherwise  valid  wiretap.”)'^;  see  also,  e.g.,  Board  of 
Educ.  V.  Earls,  536  U.S.  822,  837  (2002)  (“[T]his  Court  has  repeatedly  stated  that  reasonableness 
under  the  Fourth  Amendment  does  not  require  employing  the  least  intrusive  means,  because  the 
logic  of  such  elaborate  less-restrictive-altemative  arguments  could  raise  insuperable  barriers  to 
the  exercise  of  virtually  all  search-and-seizure  powers.”)  (internal  quotations  marks  omitted)). 
(TS^VSI/ZOCa^lT)- 

_ As  such,  the  incidental  collection  at  issue  here  is  reasonable  under  the  Fourth 

Amendment  because  it  is  a  necessary  and  unavoidable  by-prodllctncrfNSA:Veffbrt-to-obtatn-fee — 
foreign  mtelligence  infoimation  contained  witlhn  a  discrete  communication  that  is  a  part  of  a 
larger  transaction  which  could  contain  non-pertinent  communications.  See  United  States  v. 
Wuagneux,  683  F.2d  1343,  1352-53  (1 1th  Cir.  1982)  (observing  that  “a  search  may  be  as 
extensive  as  reasonably  required  to  locate  the  items  described  in  the  warrant,”  and  on  that  basis 
concluding  that  it  was  “reasonable  for  the  agents  [executing  the  search]  to  remove  intact  files, 
books,  and  folders  when  a  particular  document  within  the  file  was  identified  as  falling  within  the 
scope  of  the  waixant”);  United  States  v.  Beusch,  596  F.2d  87 1 ,  876-77  (9th  Cir.  1 979)  (rejecting 
argument  that  “pages  in  a  single  volume  of  written  material  must  be  separated  by  searchers  so 
that  only  those  pages  which  actually  contain  the  evidence  sought  may  be  seized”).  Moreover,  as 
described  in  the  response  below,  NSA  takes  the  steps  it  can  to  ensure  that  it  conducts  its  Section 
702  upstream  collection  in  a  manner  that  minimizes  the  intrusion  into  the  personal  privacy  of 
United  States  persons.  (TS//SI//OC/NF)  ~ 


12.  The  statute  requires  the  targeting  procedures  to  “be  reasonably  designed  to  ensure  that 
any  acquisition  ...  is  limited  to  targeting  persons  reasonably  believed  to  be  located  outside 
the  United  States  and  [to]  prevent  the  intentional  acquisition  of  any  communication  as  to 
which  the  sender  and  all  intended  recipients  arc  laiown  at  the  time  of  the  acquisition  to  be 
located  in  the  United  States.”  50  U.S.C.  §  1881a(d)(l).  How  can  procedures  that 
contemplate  the  Icnowing  acquisition  of  huge  volumes  of  transactions  that  will  include 
quantifiable  amounts  of  information  relating  to  non-targets,  including  information  of  or 
about  U.S.  persons  abroad  or  persons  located  in  the  United  States,  meet  this  statutory 
requirement? 


These  cases  upholding  the  Fourth  Amendment  reasonableness  of  Title  III  suiveillances  that  resulted  in  the 
acquisition  of  significant  amounts  of  nonpertinent  communications  are  particularly  noteworthy  given  that  Title 
Iain’s  requirement  to  miniinize  the  acquisition  of  such  communications  is  considerably  stricter  than  FISA’s.  See 
11. R.  Rep.  95-1283,  pt.  1,  at  56  (“It  is  reco^ized  that  given  the  nature  of  intelligence  gathering,  minimizing 
acquisition  should  not  be  strict  as  under  [Title  III]  with  respect  to  law  enforcement  surveillances.’’).  (TS//SI//NF^ 
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For  the  reasons  more  particularly  discussed  in  its  response  to  question  l.b.ii.  in  the  June  1 
Submission,  which  took  into  account  the  means  by  winch  conmmnications  to,  from,  or  about  a 
tasked  selector  are  acquired  through  NSA’s  upstream  Internet  collection  teclmiques,  the 
Government  respectfully  submits  that  NSA’s  targeting  procedures  are  reasonably  designed  to 
ensure  that  an  authorized  acquisition  is  limited  to  targeting  persons  reasonably  believed  to  be 
located  outside  the  United  States,  and  to  prevent  the  intentional  acquisition  of  any 
communication  as  to  winch  the  sender  and  all  intended  recipients  are  known  at  the  time  of  the 
acquisition  to  be  located  witliin  the  United  States.  See  June  1  Submission  at  3-12,  20-24.  As 
discussed  m  the  Govermnent’s  June  1  Submission,  for  acquisition  of  both  to/ffom 
cormnunications  and  abouts  conmnmications,  the  person  being  “targeted”  is  the  user  of  the 
tasked  selector,  who,  by  operation  of  the  targeting  procedures,  is  a  non-United  States  person 
reasonably  believed  to  be  located  outside  the  United  States.  See  June  1  Submission  at  3-4.  Tliis 
remains  tme  for  all  Section  702  upstream  acquisitions,  including  the  acquisition  of  transactions 
containing  several  discrete  communications,  only  one  of  winch  may  be  to,  from,  or  about  the 
user  of  a  tasked  selector.  -  (TS/ZS  IZ/NF) 


Specifically,  tlie  sole  reason  a  transaction  is  selected  for  acquisition  is  that  it  contains  the 
presence  of  a  tasked  selector  used  by  a  person  who  has  been  targeted  in  accordance  with  NSA’s 


targeting  procedures.  hideed,  at  the  time  a  transaction  is  acquired,  NSA  camiot  always  know 


whether  the  transaction  includes  other  data  or  infomiation  representing  communications  that  are 
not  to,  from,  or  about  fnrcrp.t,  let  alone  always  have  knowledge  of  the  parties  to  those 


cormnunications.  Q 


Mem.  Op.  at  18-19  (noting  that  with  respect  to  abouts 


communications,  “the  government  may  have  no  knowledge  of  [the  parties  to  a  connnunication] 


prior  to  acquisition”).  Tt  therefore  caimot  be  said  that  the  acquisition  of  a  transaction  containing 
multiple  discrete  connnunications  results  in  the  intentional  targeting  of  any  of  the  parties  to  those 


communications  other  than  the  user  of  the  tasked  selector.  Cf.  Bin  Laden,  1 26  F.  Supp.  2d  at  281 
(acknowledging  that  in  liglit  of  United  States  v.  Verdugo-Urquidez,  494  U.S.  259,  265  (1990), 
and  Title  III  “incidental  interception”  case  law,  overseas  surveillance  of  a  United  States  person 
terrorism  suspect  would  have  posed  no  Fourth  Amendment  problem  “if  the  Goveimnent  had  not 
been  aware  of  [Iris]  identity  or  of  his  complicity  in  the  [teraorism]  enterprise”).  The  fact  that  a 
transaction  acquired  pursuairt  to  the  targeting  procedures  may  also  contain  cornmunications  to, 
from,  or  about  persons  other  than  the  user  of  the  tasked  selector  does  not  mean  those  persons  are 
likewise  being  targeted  by  that  acquisition.  Cf.  H.R.  Rep.  No.  95-1283,  pt.  1 ,  at  50  (explaining, 
with  regard  to  electronic  suiweillance  as  defined  by  50  U.S.C.  §  1 801(f)(1),  that  “[t]he  term 
‘mtentionally  targeting’  includes  the  deliberate  use  of  surveillance  techniques  which  can  monitor 
numerous  chamrels  of  cormnunication  among  numerous  parties,  where  the  teclmiques  are 
designed  to  select  oirt  from  among  those  cormnunications  the  connnunications  to  which  a 
particular  U.S.  person  located  in  the  United  States  is  a  party,  arrd  where  the  cormnunications  are 


ffS//Sr//NF) 
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selected  either  by  name  or  by  other  information  wliich  would  identify  the  particular  person  and 
would  select  out  liis  conununications”).  Rather,  as  discussed  in  the  response  to  question  1 1 
above,  the  aequisition  of  such  non-pertinent  communications  is  incidental  to  the  purpose  of  the 
collection  as  a  whole  and  therefore  reasonable  under  the  Fourth  Amendment.  (TS//SI//N-F)' 


Similarly,  to  the  extent  that  one  of  the  discrete  non-pertinent  communications  within  an 
acquired  transaction  is  a  communication  in  wliich  the  sender  and  all  intended  recipients  were 
located  in  tlie  United  States  at  the  time  of  acquisition,  the  acquisition  of  tins  wholly  domestic 
communication  would  be  incidental  and,  as  discussed  m  response  to  question  1 0  above, 
unintentional.  NSA’s  targeting  procedures  require  that,  in  conducting  upstream  collection  of 
abouts  communications,  NSA  either  employ  “an  Internet  Protocol  filter  to  ensure  that  theperson 
seeks  to  obtain  foreign  intelligence  infoimation  is  located  overseas”  or 

E.g.,  Amendment  1  to  DNI/AG  702(g) 


Ex.  A,  filed 


Certi^ation 

Mem.  Op.  at  19.  The  Court  has  previously  found  tha 
“reasonably  designed  to  prevent  the  intentional 
parties  are  in  the  United  States,”  wliile  recognizing  that  it  is 
imunication  could  be  aequired  as  a  result  of  the] 

.  Mem. 

jubm^ion,  apart  from  one  exception  involving 


2010,  at  1-2;  see  also 


neans  were 


iblethatawholly 


11.17.  As  discussed  in  the 


,  NSA  analysts  have  yet  to  identify  a  wholly  domestic  communication  acquired 
tlirough  NSA’s  upstream  collection  systems.  See  June  1  Submission  at  8-9.  Accordingly,  the 
Government  continues  to  believe  that  NSA’s  m^^means  for  preventing  the  acquisition  of 
wholly  domestic  conununications  remain  efficacious,  and  that  the  theoretical  scenarios  in  wliich 
NSA  would  acquire  a  wholly  domestic  communication  do  not  prevent  tlie  Court  from  continuing 
to  find  that  NSA’s  targeting  procedures  are  reasonably  designed  to  prevent  the  intentional 
acquisition  of  communications  as  to  which  the  sender  and  all  intended  recipients  are  known  at 
the  time  of  acquisition  to  be  in  the  United  States.  ■  (TS//SI//OC/f4P)' 


To  the  extent  that  NSA  does  unintentionally  acquire  and  then  recognize  such  a  wholly 
domestic  communication  within  an  acquired  transaction,  as  described  in  response  to  question  10 
above,  NSA  would  be  required  to  purge  the  entire  transaction,  unless  the  Attorney  General 
determined  “that  the  contents  indicatefd]  a  threat  of  death  or  serious  bodily  hann  to  any  person.” 
•(■T-S//SI//OC/i^F) 


13.  In  its  discussion  of  the  Fourth  Amendment,  the  government  asserts  that  “upstream 
collection”  in  general  is  “an  essential  and  irreplaceable  means  of  acquiring  valuable  foreign 
intelligence  information  that  promotes  the  paramount  interest  of  protecting  the  Nation  and 
conducting  its  foreign  affairs.”  June  1  Submission  at  16. 


a.  To  what  extent  can  the  same  be  said  for  the  acquisition  of  Internet  transactions 
I)  in  particular? 
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b.  Is  the  acquisition  of  Internet  transactions  via  upstream  collection  the  only  source  for 
certain  categories  of  foreign  intelligence  information?  If  so,  what  categories? 


c.  Please  describe  with  particularitj'  what  information  NSA  would  acquire,  and  what 
Information  NSA  would  not  acquire,  if  NSA  were,  in  comparison  to  its  current 
collection,  to  limit  its  acquisitioiijof  Internet  communications  to;  (1)  acquisitions 
conduct^  with  the  assistance  of 
and  (2)  the  upstrea 
about  tasked  selectors  that  are 
(id.  at  2, 11.2). 


The  Goverament’s  assertion  that  upstream  collection  is  “an  essential  and  iixeplaceable  means 
of  acquiring  valuable  foreign  intelligence  infomiation  that  promotes  the  paramount  interest  of 
protecting  the  Nation  and  conducting  its  foreign  affairs”  is  equally  applicable  to  its  acquisition  of 
Tiiternet  transactions.  This  is  ti'ue  because  the  Government’s  acquisition  of 

is  not  a  subset  of  its  upstream  collection  of  Internet  commumcations.  Instead,  acquisition  of 

Internet  transactions  is  the  teclmical  means  by  wliich  all  upstream  collection  of  Internet 
communications  accounts  are  acquired.  (TS//SI//NF) 


Section  702  upstream  collection  of  hitemet  communications  provides  NSA  with  certain 
types  of  mfoimation  (further  described  below)  which  are  extremely  valuable  to  its  national 
security  mission.  Dissemuiated  end  product  reports  derived  from  tins  collection  have  proven  to 
be  of  critical  value  to  high-level  customers,  including  the  ^Vllite  House,  State  Deparhnent  Joint 
Cliiefs  of  Staff,  the  National  Counteiproliferation  Center,  Central  Intelligence  Agency  (CLA), 
Defense  hitelligence  Agency,  Federal  Bureau  of  Investigation  (FBI),  and  others,  hi  addition. 


(TS//SI//NF)- 


Section  702  upstream  collection  offers  unique  opportunities  to  detect  target  information, 
includmg  but  not  lunited  to  the  following  examples; 
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r^o^iz^NS  A’ s  upsti^eamroll^ion^  capable  of  acquiring  certain  types  of 

targeted  communications  containing  valuable  foreign  intelligence  information.  In  i  s  DNI/AG 
- - g^Mem.  Op.  at  25-26  (USFISC  2009) 


Certification 


(emphasis  added;  internal  citations  omitte 


Additionally,  NSA’s  Section  702  upstream  collection  would  not  acquire  many  of  the 
above  categories  of  coimnunications,  and  thus  the  foreign  intelligence  contained  within  these 
conununications,  if  NSA’s  upstream  collection  were  limited  to  acquisition  solely  (rf  disci  ete 


communications  to,  from,  or  about  tasked  selectors  that  are 


rrferenced  in  footnote  2  on  page  2  oHhe^neT^i^ifsiOTTT^Si!^ 


('l’S//SI//NF) 
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(TS//SI//Nj^ 


The  Court’s  question  asks  for  “categories  of  foreign  intelligence  infomration”  that  can  be 
obtained  exclusively  toough  NSA’s  acquisition  of  Internet  transactions  via  upstream  collection. 
This  is  a  difficult  question  to  answer,  as  types  of  fomigmntelligenc^naj^^onv^^ 
rmunication  means.  For  example, 

described  above,  it  is  entirely  possit  _ 
be  acquired  through  NSA’s  Section  702  upstream  collection  of  coimnunications  other  than  those 


In  an  effort  to  fiilly  answer  tlie  Court’s  question,  however,  the  Government  respectfully 
submits  the  following  examples  of  instances  where  NSA  has  obtained  substantial  forei^ 
intelligence  information  from  Section  702  upstream  collection.  The  examples  detail  only  a  few 
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of  the  many  instances  in  wliich  Section  702  upstream  collection  has  provided  such  substantial 

foreign  intelligence.  In  many  of  these  examples,  Section  702  upstream  collection  provided 
■ .  .. Although  all  forms  of 


impoitant  leads  that  led  to 

Section  702  upstream  collection  have  proved  to  be  of  cntical  importance  to  the  NSA  s  nation 

security  mission,  the  examples  bdowinvolgtheac^isitionbySecUo^O^i^^ 

(TS//SI//NFt 
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14.  The  Fourth  Amendment  also  requires  the  Court  to  examine  the  nature  and  scope  of  the 
intrusion  upon  protected  privacy  interests.  How  can  the  Court  conduct  such  an  assessment 
if  the  government  itself  is  unable  to  describe  the  nature  and  scope  of  the  information  that  is 
acquired  or  the  degree  to  which  the  collection  includes  information  pertaining  to  U.S. 
persons  or  persons  located  in  the  United  States? 

Although,  as  discussed  above,  it  is  difficult  for  the  Government  to  fully  describe  to  the 
Court  every  possible  type  of  information  that  may  be  contained  within  a  transaction  acquned 
through  NSA’s  upstream  collection,  the  Govermnent  respectfully  suggests  that  the  Court  can 
nonetheless  assess  whether  NSA’s  upstream  collection  of  such  transactions  is  reasonable  under 
the  Fourth  Amendment.  -(TS//SI//OC/NF)- 

First,  the  Supreme  Court  has  recognized  that  an  appreciation  of  all  of  the  possible  ways  a 
search  can  intnrde  upon  interests  protected  by  the  Fourth  Amendment  is  not  an  indispensable 
component  of  assessing  the  reasonableness  of  the  search.  See  Dalia  v.  United  States,  441  U.S. . 
238,  257  (1979)  (“Often  in  executing  a  wamant  the  police  may  find  it  necessary  to  interfere  with 
privacy  rights  not  explicitly  considered  by  the  judge  who  issued  the  warrant,”);  cf.  Payton  v.  New 
York,  445  U.S.  573,  601-02  (1980)  (recognizing  that  “for  Fourth  Amendment  purposes,  an  arrest 
warrant  founded  on  probable  cause  implicitly  canies  with  it  the  limited  authority  to  enter  a 
dwelling  in  which  the  suspect  lives  when  there  is  reason  to  believe  the  suspect  is  within,”  even 
though  “an  an'cst  warrant  requirement  may  afford  less  [privacy]  protection  than  a  search  warrarrt 
requirement”).  Thus,  the  Government  respectfully  suggests  that  the  Court  can  assess  the  Fourth 
Amendment  reasonableness  of  NSA’s  upstream  collection  even  if  the  Govermnent  cannot  fully 
describe  every  possible  type  of  information  that  collection  may  acquire.  (TS//SI//OC/NF) 
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Moreover,  while  it  may  be  difficult  for  the  Government  to  describe  the  full  scope  of  the 
types  of  information  that  may  be  acquired  by  NSA’s  upstream  collection,  it  is  nevertheless 
possible  to  ascertain  the  degi’ec  to  wliich  that  information  would  pertain  to  United  States  persons 
or  persons  located  in  the  United  States.  For  tlie  reasons  discussed  below,  the  Government  does 
not  believe  that  infonnation  about  United  Stales  persons  or  persons  located  m  the  United  States 
would  be  acquired  tlurough  NSA’s  upstream  collection  of  transactions  to  a  greater  degi'ee,  hi 
relative  terms,  tlian  other  types  of  communications  acquired  under  Section  702.  (TG/ZGI/ZOC/NT) 


Fu’st,  certam  transactions  are  acquired  because  they  contain  a  discrete  communication  to 
or  from  a  tasked  selector  used  by  a  person  who,  by  virtue  of  the  application  of  NSA’s  FISC- 
approved  targeting  procedures,  is  a  non-United  States  person  reasonably  believed  to  be  located 
outside  the  United  States.  This  Court  has  recognized  that  “the  vast  majority  of  persons  who  are 
located  overseas  are  non-United  States  persons  and  that  most  of  tlieir  communications  are  with 
other,  non-United  States  persons,  who  are  located  overseas.”  In  re  Directives  to  Yahoo!  Mem. 
Op.  at  87  (footnote  omitted).  Accorduigly,  it  is  reasonable  to  pre.sume  that  most  of  the  discrete 
communications  that  may  be  within  the  acquired  transaction  are  between  non-Umted  States 
persons  located  outside  the  United  States.  Second,  with  respect  to  transactions  that  contain  a 
discrete  communication  about  a  tasked  selector,  the  technical  means  by  wliich  NSA  prevents  the 
intentional  acquisition  of  wholly  domestic  conmiunications  is  to  ensure  that  the  acquisition  of 
transactions  is  directed  at  persons  reasonably  believed  to  be  located  outside  the  United  States. 
Again,  these  individuals  reasonably  can  be  presimied  to  be  non-United  States  persons,  and  most 
of  their  communications  can  be  presumed  to  be  with  other  non-United  States  persons  located 
outside  the  United  States.  Id.  This  combination  of  targeting  non-United  States  persons  located 
outside  the  United  States  and  directing  acquisitions  at  persons  located  outside  the  United  States 
operates  to  significantly  diminish  the  likelihood  that  information  pertaining  to  United  States 
persons  or  persons  in  the  United  States  will  be  acquired.  fFS//SFyOC/NF) 


To  be  sure,  it  is  possible  that  a  ti'ansaction  containing  multiple  discrete  communications 
only  one  of  which  is  to,  from,  or  about  a  tasked  selector  could  contain  information  pertainuig  to 
United  States  persons  or  persons  in  tlie  United  States.  That,  however,  does  not  by  itself  mean 
that  the  volume  of  such  infonnation  in  transactions  will  be  greater  than  in  the  collection  of  other 
jes  of  coimnunications  that  have  previously  been  discussed  and  approved. 


Moreover,  the  fact  that  witliin  an  acquired  transaction  there  may  be  multiple  discrete 
coimnunications  containing  infomiation  pertaining  to  United  States  persons  or  persons  in  the 
United  States  cannot  by  itself  render  the  acquisition  of  that  transaction  umeasonable  under  the 
Fourth  Amendment.  As  discussed  above,  the  acquisition  of  such  infomiation  is  incidental  to  the 
purpose  of  the  transaction’s  acquisition  —  the  acquisition  of  the  discrete  communication(s)  to. 
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from,  or  about  a  tasked  selector  witliiu  the  transaction.  See  In  re  Directives,  551  F.3d  at  1015 
(“It  is  settled  beyond  peradventure  that  incidental  collections  occurring  as  a  result  of 
constitutionally  permissible  acquisitions  do  not  render  those  acquisitions  unlawful.”)  (citations 
omitted)).  -(TS/y^I//QC/NF) 


In  any  event,  any  infonnation  pertaining  to  a  United  States  person  or  person  located  in 
the  United  States  present  in  a  transaction  containing  multiple  discrete  communications  would  be 
handled  under  the  NSA  minimization  procedures  in  the  exact  same  manner  as  if  that  information 
appeared  in  a  discrete  communication  to,  from,  or  about  a  tasked  selector.  For  example,  the  use 
and  dissemination  of  United  States  person  information  acquired  fi'om  ; 

I  would  be  subject  to  the  same  restrictions  as  United  States  person  inlormation  acquirea  iron 


iTS/ZSI/ZOC/T^iF) 


15.  In  light  of  the  government’s  emphasis  on  the  limited  querying  ot  Section  702 
acquisitions  that  is  currently  permitted  (see  June  1  Submission  at  23),  why  is  it  reasonable 
and  appropriate  to  broaden  the  targeting  procedures  to  permit  querying  using  U.S.-pcrson 
identifiers? 

Although  NSA’s  cuixent  minimization  procedures  proliibit  the  use  of  United  States 
person  names  or  identifiers  to  retrieve  any  Section  702-acquired  communications  in  NSA 
systems,  see  CuiTcnt  NSA  Minimization  Procedures,  §  3(b)(5),  the  statute  requires  no  such 
limitation.  Rather,  it  is  reasonable  and  appropriate  for  the  Court  to  approve  the  Government’s 
proposal  to  enable  NSA  analysts  to  use  United  States  person  identifiers  as  selection  temis 
because  the  request  is  consistent  with  the  statutorily  required  minimization  procedures.  See 
Proposed  NSA  Minimization  Procedures  §  3(b)(5)  (providing,  in  pertinent  part,  that  “[cjomputer 
selection  terms  used  for  scamiing,  such  as  telephone  numbers,  key  words  or  plnases,  or  other 
discrimmators,  will  be  limited  to  those  selection  terms  reasonably  likely  to  return  foreign 
intelligence  information.  Any  United  States  person  identifiers  used  as  tenns  to  identify  and 
select  conmiunications  must  be  approved  in  accordance  with  NSA  procedures.”)  (emphasis 
added).  (TGZ/Giy/OQ'N-F)- 

Minimization  procedures  must  be  designed  to  minimize  the  acquisition  and  retention,  and 
prohibit  the  dissemination,  of  nonpublicly  availably  information  concerning  unconsenting  United 
States  persons  consistent  with  the  need  of  the  United  States  to  obtain,  produce,  and  disseminate 
foreign  intelligence  infonnation.  50  U.S.C.  §  1801(h)(1).  Where,  as  here,  “it  may  not  be 
possible  for  teclmical  reasons  to  avoid  acquiring  all  infoimation,”  Congress  has  recognized  that 
minimization  procedures  “must  emphasize  the  minimization  of  retention  and  dissemination.” 
H.R.  Rep.  No.  95-1283,  pt.  1,  at  55.  Congress  also  aclcnowledged  that  “a  significant  degree  of 
latitude  be  given  in  counterintelligence  and  counterterrorism  cases”  with  respect  to  retention  and 
dissemination  of  infonnation.  Id.  at  59.  In  light  of  such  latitude,  “rigorous  and  strict  controls” 
should  —  and  will  —  be  placed  on  the  retrieval  of  United  States  person  information  and  “its 
dissemination  or  use  for  puiposes  bJfier  than  counterintelligence  or  counterterrorism.”  Id.  , 
(TS//SI//OC/NF) 
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With  respect  to  acquisition,  the  Government’s  proposal  to  use  United  States  person 
identifiers  as  selection  tenns  does  not  broaden  the  scope  of  what  the  Govermnent  can  acquire 
under  the  certifications.  Because,  for  the  reasons  detailed  above,  it  is  not  possible  “to  avoid 
acquiring”  the  incidentally  obtained  information,  the  focus  will  be  on  the  retention  and 
dissemination  provisions  of  the  procedures.  Id.  at  55.  Asa  general  matter,  NSA’s  minimization 
procedures  contain  detailed  provisions  regarding  the  retention  and  dissemination  of  United  States 
person  infoimation  that  the  Court  has  previously  approved.  See,  e.gM|||ttMMem.  Op.  at  21-32, 
40-41.  In  addition,  the  Govermnent’s  proposal  provides  that  United  sim^^Son  identifiers 
may  only  be  used  “in  accordance  with  NSA  procedures”  governing  the  circumstances  under 
wliich  U.S.  person  infoimation  can  be  queried.  Although  the  Government  is  still  developing 
such  procedures,  and  NSA  analysts  will  not  begin  using  United  States  identifiers  as  selection 
terms  until  they  are  completed,  the  Government  will  ensure  that  the  procedures  contain  “rigorous 
and  strict  controls”  for  the  rehieval  and  dissemination  of  United  States  person  information  to 
ensure  that  only  selection  teims  likely  to  produce  foreign  intelligence  information  are  retrieved, 
and  dissemination  is  limited  to  counterintelligence  and  counterten'orism  puiposes.  Moreover, 

the  Govenmient’s  proposed  changes  to  NSA’s  mimmization  procedures  require  fhafNSA - 

maintain  records  of  all  United  States  person  identifiers  approved  for  use  as  selection  teims  and 
that  NSD  and  ODNI  conduct  oversight  of  NSA’s  activities.  See  Proposed  NSA  Minimization 
Procedures  §  3 (b)(5).  ntTG//3LVOC/NF) 


16.  The  government  acknowledges  that  it  previously  “did  not  fully  explain  all  of  the  means 
by  which  . . .  communications  arc  acquired  through  NSA’s  upstream  collection  techniques” 
(June  1  Submission  at  2),  yet  states  that  the  “[Attorney  General]  and  [Director  of  National 
Intelligence]  have  confirmed  that  their  prior  authorizations  remain  valid”  (i^  at  35).  At 
the  time  of  each  previous  Certification  under  Section  702,  were  the  Attorney  General  and 
the  Director  of  National  Jn^igence  aware  that  the  acquisitions  being  approved  included 
Internet  “transactions” If  so,  why  was  the  Court  not  informed? 
If  not,  why  are  the  prior  Certificationsandcou^tions  still  valid? 

The  Government  acbiowledges  that  its  prior  representations  to  the  Court  —  and  to  the 
Attorney  General  and  Director  of  National  hitclligence  —  regarding  the  steps  NSA  must  take  in 
order  to  acquire  single,  discrete  communications  to,  from,  or  about  a  tasked  selector  did  not  fully 
explain  all  of  the  means  by  which  such  communications  arc  acquired  through  NSA’s  upstream 
hitemet  collection  techniques.  See  June  1  Submission  at  2.  That  said,  for  the  reasons  described 
in  the  answer  to  question  5  in  the  June  1  Submission,  botli  the  prior  Certifications  and  collection 
remain  valid.  5'ee  June  1  Submission  at  31-38.  (TS//SI//QC/NF) 

The  Certifications  executed  by  the  AG  and  DNI  and  submitted  to  the  Court  for  approval 
were  based  on  an  understanding  that  Section  702  collection  would,  at  a  minimum,  acquire 
discrete  communications  that  are  to,  from,  or  about  a  tasked  selector.  As  described  in  detail 
previously,  due  to  certain  technological  limitations,  in  general  the  only  way  that  NSA  can 
acquire  certain  Internet  communications  upstream  that  are  to,  fr'om,  or  about  a  tasked  selector  is 
by  acquiring  an  Internet  transaction  wliichmay  include  a  single,  discrete  communication  to,  fi'ora, 
or  about  a  tasked  selector  (e.g.,  an  e-mail  message)  or  may  include  several  discrete 
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communications,  only  one  of  wliich  may  be  to,  from,  or  about  a  tasked  selector.  See  June  1 
Submission  at  27-28.  In  this  respect,  the  acquisition  is  comparable  to  the  Government’s  seizure 
of  a  video,  book,  or  intact  file  that  contains  a  single  photo,  page,  or  document  that  a  search 
waiTant  authorizes  the  Govenunent  to  seize.  See,  e.g..  United  States  v.  Rogers,  521  F.3d  5,  10 
(1st  Cir.  2008)  (concluding  that  a  videotape  is  a  “plausible  repository  of  a  photo”  and  that 
tlierefore  a  wan'ant  authorizing  seizure  of  “photos”  allowed  the  seizure  and  review  of  two 
videotapes,  even  though  wan’ant  did  not  include  videotapes);  Wuagneux,  683  F.2d  at  1353 
(holding  that  it  was  “reasonable  for  the  agents  to  remove  intact  files,  books  and  folders  when  a 
particular  document  within  the  file  was  identified  as  falling  within  the  scope  of  the  warrant.”); 
United  States  v,  Christine,  687  F.  2d  749,  760  (3d  Cir.  1982)  {en  banc)  (emphasizing  tliat  “no 
tenet  of  the  Fourth  Amendment  prolribits  a  search  merely  because  it  caimot  be  perfonned  with 
surgical  precision.  Nor  does  the  Fourth  Amendment  prohibit  seizure  of  an  item,  such  as  a  single 
ledger,  merely  because  it  happens  to  contain  other  infonnatiou  not  covered  by  the  scope  of  the 
warrant.”);  United  States  v.  Beusch,  596  F.2d  871,  876-77  (9th  Cir.  1979)  (rejecting  argument 
that  “pages  in  a  single  volume  of  written  material  must  be  separated  by  searchers  so  that  only 
those  pages  which  actually  contain  the  evidence  may  be  seized").  None  of  these  cases  eveniiinlr 
that  the  wan'ant  is  somehow  invalid  because  the  magistrate  did  not  know  in  advance  that  the 
search  or  seizure  of  authorized  documents  or  photos  would  also  encompass  the  search  or  seizure 
of  additional,  intermingled  documents  or  photos,  even  in  cases  where  such  documents  could 
have  been  physically  separated  from  the  larger  files  or  books  in  wliich  they  were  contained. 
Rather,  it  is  well-established  that  warrants  need  not  state  with  specificity  the  precise  mamier  of 
execution,  and,  so  long  as  it  is  reasonable,  a  search  or  seizure  will  be  upheld  even  if  conducted  in 
a  mamier  that  invades  privacy  in  a  manner  not  considered  at  the  time  the  warrant  was  issued. 

See  United  States  v.  Grubbs,  547  U.S.  90,  98  (2006)  (‘TSlothing  in  the  language  of  the 
Constitution  or  in  tliis  Court’s  decisions  interpreting  that  language  suggests  that,  in  addition  to 
the  [requirements  set  forth  in  the  text],  search  warrants  also  must  include  a  specification  of  the 
precise  mamier  in  wliich  they  are  to  be  executed.”)  (citation  omitted);  Dalia,  441  U.S.  at  259 
(“Often  in  executing  a  warrant  the  police  may  find  it  necessary  to  interfere  with  privacy  rights 
not  explicitly  considered  by  the  judge  who  issued  the  warrant.”).  (TS//SI//OC/NF) — 

Moreover,  having  considered  the  additional  infonnatiou  that  is  being  presented  to  this  ■ 
Court,  the  AG  and  DNI  have  confirmed  that  the  collection  fully  complies  with  the  statutoiy 
requirements  of  Section  702,  as  well  as  the  Fourth  Amendment,  and  that  therefore  the  prior 
Certifications  and  collection  remain  valid.  See  June  1  Submission  at  35.  (TS//SI//OC/NF) 


As  discussed  previously,  transactions  are  only  acquired  if  they  contain  at  least  one 
discrete  coimnunication  to,  fi'om,  or  about  a  tasked  selector.  Each  tasked  selector  has  undergone 
review,  prior  to  tasking,  to  ensure  that  the  user  is  a  non-United  States  person  reasonably  believed 
to  be  outside  the  United  States.  Moreover,  with  respect  to  “abouts  communications,”  the 
targeting  procedures  are  also  reasonably  designed  to  prevent  the  intentional  acquisition  of  any 
communication  as  to  wliich  the  sender  and  all  intended  recipients  are  known  to  be  located  in  the 
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United  States  at  the  time  of  acquisition,  See  id.  at  3-12,  28-30.  Just  as  the  Government’s 
acquisition  of  an  enthe  book  based  on  the  fact  that  a  smgle  page  falls  within  the  scope  of  the 
warrant  does  not  call  into  question  the  warrant’s  specificity,  the  incidental  acquisition  of 
additional  coimnunications  that  are  not  to,  from,  or  about  tire  tasked  selector  does  not  negate  the 
validity  of  the  targeting  procedures  that  are  relied  on  to  acquire  a  particular  transaction. 
-(T-S//Sfr/OC/l'Jr) 

Moreover,  tlie  AG  and  DNI  have  confirmed  that  the  additional  infonnation  regarding 
incidentally  acquired  communications  does  not  alter  the  validity  of  their  prior  Certifications.  See 
id.  at  35.  As  discussed  in  detail  previously,  the  minimization  and  targeting  procedures  fully 
comport  with  all  of  the  statutory  requirements,  mcluding  tire  requiremerrt  that  the  targeting 
procedures  are  reasonably  designed  to  prevent  the  intentional  acquisition  of  any  communication 
as  to  wlrich  the  sender  and  all  intended  reeijrients  are  kirown  at  the  time  of  the  acquisition  to  be 
located  within  the  United  States,  see  id.  at  3-12,  20-24;  and  the  procedures  and  guidelines  are 
consistent  with  the  requirenreuts  of  the  Fourth  Anrendment,  see  id.  at  13-24.  (■TS//'Sjy/OGQ4F)- 
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MINIMIZATION  PROCEDURES  USED  BY  THE  NATIONAL  SEClMt^lukdiNCIT 
CONNECTION  WITH  ACQUISITIONS  OF  FOREIGN  INTELLIGENCE 
INFORMATION  PURSUANT  TO  SECTION  702  OF  THE  FOREIGN TNlELElGEN^  f  i 
SURVEILLANCE  ACT  OF  1978,  AS  AMENDED  ’  '  j  ^ 

(U)  Section  1  -  Applicability  and  Scope 

/ 

(U)  These  National  Security  Agency  (NSA)  minimization  procedures  apply  to  the 
acquisition,  retention,  use,  and  dissemination  of  information,  including  non-publicly 
available  information  concerning  unconsenting  United  States  persons,  that  is  acquired  by 
targeting  non-United  States  persons  reasonably  believed  to  be  located  outside  the  United 
States  in  accordance  with  section  702  of  the  Foreign  Intelligence  Surveillance  Act  of  1978, 
as  amended  (FISA  or  "the  Act"). 


(U)  If  NSA  determines  that  it  must  take  action  in  apparent  departure  from  these 
minimization  procedures  to  protect  against  an  immediate  threat  to  human  life  (e.g.,  force 
protection  or  hostage  situations)  and  that  it  is  not  feasible  to  obtain  a  timely  modification  of 
these  procedures,  NSA  may  take  such  action  immediately.  NSA  will  report  the  action  taken 
to  the  Office  of  the  Director  of  National  Intelligence  and  to  tire  National  Security  Division  of 
the  Department  of  Justice,  which  will  promptly  notify  the  Foreign  Intelligence  Surveillance 
Court  of  such  activity. 


(S//NF)  Nothing  in  these  procedures  shall  restrict  NSA's  performance  of  lawful  oversight 
functions  of  its  personnel  or  systems,  or  lawful  oversight  functions  of  the  Department  of 
Justice's  National  Security  Division,  Office  of  the  Director  of  National  Intelligence,  or  the 
applicable  Offices  of  the  Inspectors  General.  Additionally,  nothing  in  these  procedures  shall 
restrict  NSA's  ability  to  conduct  vulnerability  or  network  assessments  using  infoimation 
acquired  pursuant  to  section  702  of  the  Act  in  order  to  ensure  that  NSA  systems  are  not  or 
have  not  been  compromised.  Notwitlrstanding  any  other  section  in  these  procedures, 
information  used  by  NSA  to  conduct  vulnerability  or  network  assessments  may  be  retained 
for  one  year  solely  for  that  limited  purpose.  Any  information  retained  for  this  purpose  may 
be  disseminated  only  in  accordance  with  the  applicable  provisions  of  these  procedures. 


(U)  For  the  purposes  of  these  procedures,  the  terms  "National  Security  Agency"  and  "NSA 
personnel"  refer  to  any  employees  of  the  National  Security  Agency/Central  Security  Service 
("NSA/CSS"  or  "NSA")  and  any  other  persomiel  engaged  in  Signals  Intelligence  (SIGINT) 
operations  authorized  pursuant  to  section  702  of  the  Act  if  such  operations  are  executed 
under  the  direction,  authority,  or  control  of  the  Director,  NSA/Chief,  CSS  (DIRNSA). 

(U)  Section  2  -  Definitions 

(U)  In  addition  to  the  definitions  in  sections  101  and  701  of  the  Act,  the  following 
definitions  will  apply  to  these  procedm'es: 

Derived  From:  NSA/CSSM  1-52 
Dated:  20070108 
Declassify  On:  20320iefr 
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(a)  (U)  Acquisition  means  the  collection  by  NS  A  or  the  Federal  Bureau  of  Investigation 
(FBI)  through  electronic  means  of  a  non-public  communication  to  which  it  is  not  an 
intended  party. 

(b)  (U)  Communications  concerning  a  United  States  person  include  all  eommunieations  in 
wliich  a  United  States  person  is  discussed  or  mentioned,  except  where  such 
communications  reveal  only  publicly  available  infonnation  about  the  person. 

(c)  (U)  Communications  of  a  United  States  person  include  all  communications  to  which  a 
United  States  person  is  a  party. 

(d)  (U)  Consent  is  the  agreement  by  a  person  or  organization  to  permit  the  NSA  to  take 
particular  actions  that  affect  the  person  or  organization.  To  be  effective,  consent  must  be 
given  by  the  affected  person  or  organization  with  sufficient  knowledge  to  understand  the 
action  that  may  be  taken  and  the  possible  consequences  of  that  action.  Consent  by  an 
organization  will  be  deemed  valid  if  given  on  behalf  of  the  organization  by  an  official  or 
governing  body  determined  by  the  General  Counsel,  NSA,  to  have  actual  or  apparent 
authority  to  make  such  an  agreement. 

(e)  (U)  Foreign  communication  means  a  communication  that  has  at  least  one  communicant 
outside  of  tlie  United  States.  All  other  eommunieations,  including  cormnuni cations  m 
which  the  sender  and  all  intended  recipients  are  reasonably  believed  to  be  located  in  the 
United  States  at  the  time  of  acquisition,  are  domestic  communications. 

(f)  (U)  Identification  of  a  United  States  person  means  (1)  the  name,  unique  title,  or  address 
of  a  United  States  person;  or  (2)  other  personal  identifiers  of  a  United  States  person  when 
appearing  in  the  context  of  activities  conducted  by  tliat  person  or  activities  conducted  by 
others  that  are  related  to  that  person.  A  reference  to  a  product  by  brand  name,  or 
manufacturer's  name  or  the  use  of  a  name  in  a  descriptive  sense,  e.g.,  "Monroe  Doctrine," 
is  not  an  identification  of  a  United  States  person. 

(g)  (TS//SI//NF)-  Internet  transaction,  for  puiposes  of  these  procedures,  means  an  Internet 

communication  that  is  acquired  through  NSA's  upstream  collection  techniques.  An 
Internet  transaction  may  contain  information  or  data  representing  either  a  discret^^^ 
communication  multiple  discrete  communications 


(li)  (U)  Processed  or  processing  means  any  step  necessary  to  convert  a  communication  into 
an  intelligible  form  intended  for  human  inspection. 

(i)  (U)  Publicly  available  information  means  information  that  a  member  of  the  public  could 
obtain  on  request,  by  research  in  public  sources,  or  by  casual  observation. 

(j)  (U)  Technical  data  base  means  information  retained  for  cryptanalytic,  traffic  analytic,  or 
signal  exploitation  purposes. 


TOP  SECRET//SI//NOFORN//2032010fr 

2 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1049  of  1298 
TOP  SECRET//S1//NOFORN//2Q3101Q8 


(k)  (U)  United  States  person  means  a  United  States  person  as  defined  in  the  Act.  The 

following  guidelines  apply  in  determining  whether  a  person  whose  status  is  unknown  is  a 

United  States  person: 

(1)  (U)  A  person  known  to  be  currently  in  the  United  States  will  be  treated  as  a  United 
States  person  unless  positively  identified  as  an  alien  who  has  not  been  admitted  for 
permanent  residence,  or  unless  the  nature  or  circumstances  of  the  person's 
communications  give  rise  to  a  reasonable  belief  that  such  person  is  not  a  United 
States  person. 

(2)  (U)  A  person  loiown  to  be  currently  outside  the  United  States,  or  whose  location  is 
unknown,  will  not  be  treated  as  a  United  States  person  unless  such  person  can  be 
positively  identified  as  such,  or  the  nature  or  circumstances  of  the  person's 
communications  give  rise  to  a  reasonable  belief  that  such  person  is  a  United  States 
person. 

(3)  (U)  A  person  who  at  any  time  has  been  known  to  have  been  an  alien  admitted  for 
lawful  permanent  residence  is  treated  as  a  United  States  person.  Any  deteimination 
that  a  person  who  at  one  time  was  a  United  States  person  (mcluding  an  alien  admitted 
for  lawful  permanent  residence)  is  no  longer  a  United  States  person  must  be  made  in 
consultation  with  the  NS  A  Office  of  General  Counsel. 

(4)  (U)  An  unincorporated  association  whose  headquarters  or  primary  office  is  located 
outside  the  United  States  is  presumed  not  to  be  a  United  States  person  unless  there  is 
information  indicating  that  a  substantial  number  of  its  members  are  citizens  of  the 
United  States  or  aliens  lawfully  admitted  for  peimanent  residence. 

(U)  Section  3  -  Acquisition  and  Handling  -  General 

(a)  (U)  Acquisition 

(U)  The  acquisition  of  infoimation  by  targeting  non-United  States  persons  reasonably 
believed  to  be  located  outside  the  United  States  pursuant  to  section  702  of  the  Act  will  be 
effected  in  accordance  with  an  authorization  made  by  the  Attorney  General  and  Director  of 
National  Intelligence  pursuant  to  subsection  702(a)  of  the  Act  and  will  be  conducted  in  a 
manner  designed,  to  the  greatest  extent  reasonably  feasible,  to  minimize  the  acquisition  of 
information  not  relevant  to  the  autlrorized  purpose  of  the  acquisition. 

(b)  (U)  Monitoring,  Recording,  and  Handling 

(1)  (U)  Personnel  will  exercise  reasonable  judgment  in  determining  whether  information 
acquired  must  be  minimized  and  will  destroy  inadvertently  acquired  communications 
of  or  concerning  a  United  States  person  at  the  earliest  practicable  point  at  which  such 
communication  can  be  identified  either;  as  clearly  not  relevant  to  the  authorized 
purpose  of  the  acquisition  (e.g.,  the  commimication  does  not  contain  foreign 
intelligence  information);  or,  as  not  containing  evidence  of  a  crime  which  may  be 
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disseminated  under  these  procedures.  Except  as  provided  for  in  subsection  3(c) 
below,  such  inadvertently  acquired  eommunications  of  or  concerning  a  United  States 
person  may  be  retained  no  longer  than  five  years  from  the  expiration  date  of  the 
eertification  authorizing  the  coll  ection  in  any  event. 

(2)  (U)  Communications  of  or  concerning  United  States  persons  that  may  be  related  to 
the  authorized  purpose  of  the  acquisition  may  be  forwarded  to  analytic  personnel 
responsible  for  producing  intelligence  information  from  the  collected  data.  Such 
communications  or  information  may  be  retained  and  disseminated  only  in  accordance 
with  Sections  3,  4,  5,  6,  and  8  of  these  procedures. 

(3)  (U//FOUO)  As  a  communication  is  reviewed,  NSA  analyst(s)  will  detennine  whether 
it  is  a  domestic  or  foreign  communication  to,  from,  or  about  a  target  and  is  reasonably 
believed  to  contain  foreign  intelligence  information  or  evidence  of  a  crime  for 
purposes  of  assessing  how  the  communication  should  be  handled  in  accordance  with 
these  procedures. 

(4)  (U)  Handling  of  Internet  Transactions  Acquired  Through  NSA  Upstream  Collection 
Techniques 

a.  (TS//SI//NF)  NSA  will  take  reasonable  steps  post-acquisition  to  identify  and 
segregate  through  technical  means  Internet  transactions  that  cannot  be  reasonably 
identified  as  containing  single,  discrete  communications  where:  the  active  user  of 
the  transaction  (i.e.,  the  electronic  coimnunications  account/address/identifier 
used  to  send  or  receive  the  Internet  transaction  to  or  from  a  service  provider)  is 
reasonably  believed  to  be  located  in  the  United  States;  or  tlie  location  of  the  active 
user  is  unknown. 

1.  (TS//SE/NF)  Notwitlistanding  subsection  3  (b)(4)a.  above,  NSA  may  process 
Internet  transactions  acquired  through  NSA  upstream  collection  techniques  in 
order  to  render  such  transactions  mtelligible  to  analysts. 

2.  (TS/ZSI/zT-fF)  Internet  transactions  that  are  identified  and  segregated  pursuant 
to  subsection  3(b)(4)a.  will  be  retained  in  an  access-controlled  repository  that 
is  accessible  only  to  NSA  analysts  who  have  been  trained  to  review  such 
transactions  for  the  purpose  of  identifying  those  that  contain  discrete 
commimications  as  to  which  the  sender  and  all  intended  recipients  are 
reasonably  believed  to  be  located  in  tlie  United  States. 

(a)  (TS//SF/NF)  Any  information  contained  in  a  segregated  Internet 
transaction  (including  metadata)  may  not  be  moved  or  copied  from  the 
segregated  repository  or  otherwise  used  for  foreign  intelligence  purposes 
miless  it  has  been  determined  tliat  the  transaction  does  not  contain  any 
discrete  communication  as  to  which  the  sender  and  all  intended  recipients 
are  reasonably  believed  to  be  located  in  tlie  United  States.  Any  Internet 
transaction  that  is  identified  and  segregated  pursuant  to  subsection 
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3(b)(4)a.  and  is  subsequently  determined  to  contain  a  discrete 
communication  as  to  which  tire  sender  and  all  intended  recipients  are 
reasonably  believed  to  be  located  in  the  United  States  will  be  handled  in 
accordance  with  Section  5  below. 

(b)  (U//FOUO)  Any  information  moved  or  copied  from  the  segregated 
repository  into  repositories  more  generally  accessible  to  NSA  analysts  will 
be  handled  in  accordance  with  subsection  3(b)(4)b.  below  and  the  other 
applicable  provisions  of  these  procedures. 

(c)  (U//FQUQ)  Any  information  moved  or  copied  from  the  segregated 
repository  into  repositories  more  generally  accessible  to  NSA  analysts  will 
be  marked,  tagged,  or  otherwise  identified  as  having  been  previously 
segregated  pursuant  to  subsection  3(b)(4)a. 

3.  (TS//SI//NP)  Internet  transactions  that  are  not  identified  and  segregated 

pursuant  to  subsection  3(b)(4)a.  will  be  handled  in  accordance  with  subsection 
3(b)(4)b.  below  and  the  other  applicable  provisions  of  these  procedures. 

b.  (U),  NSA  analysts  seeking  to  use  (for  example,  in  a  FISA  application,  intelligence 
report,  or  section  702  targeting)  a  discrete  communication  within  an  Internet 
transaction  that  contains  multiple  discrete  communications  will  assess  whether  the 
discrete  communication:  1)  is  a  communication  as  to  which  the  sender  and  all 
intended  recipients  are  located  in  the  United  States;  and  2)  is  to,  from,  or  about  a 
tasked  selector,  or  otherwise  contains  foreign  intelligence  information. 

1.  (TS//SI//NF)  If  an  NSA  analyst  seeks  to  use  a  discrete  communication  within 
an  Internet  transaction  that  contains  multiple  discrete  communications,  the 
analyst  will  first  perfoim  checks  to  deteimine  the  locations  of  the  sender  and 
intended  recipients  of  that  discrete  communication  to  the  extent  reasonably 
necessary  to  determine  whether  the  sender  and  all  intended  recipients  of  that 
communication  are  located  in  the  United  States.  If  an  analyst  determines  that 
the  sender  and  aU  intended  recipients  of  a  discrete  communication  within  an 
Internet  transaction  are  located  in  the  United  States,  the  Internet  transaction 
will  be  handled  in  accordance  with  Section  5  below. 

2.  (U)  If  an  NSA  analyst  seeks  to  use  a  discrete  communication  within  an 
Internet  transaction  that  contains  multiple  discrete  communications,  the 
analyst  will  assess  whether  the  discrete  communication  is  to,  from,  or  about  a 
tasked  selector,  or  otherwise  contains  foreign  intelligence  information. 

(a)  (U)  If  the  discrete  communication  is  to,  from,  or  about  a  tasked  selector, 
any  U.S.  person  information  in  that  communication  will  be  handled  in 
accordance  with  the  applicable  provisions  of  these  procedures. 
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(b)  (U)  If  the  discrete  communication  is  not  to,  from,  or  about  a  tasked 
selector  but  otherwise  contains  foreign  intelligence  information,  and  the 
discrete  communication  is  not  to  or  from  an  identifiable  U.S.  person  or  a 
person  reasonably  believed  to  be  located  in  the  United  States,  that 
communication  (including  any  U.S.  person  infomiation  therein)  will  be 
handled  in  accordance  with  the  applicable  provisions  of  these  procedures. 

(c)  (U)  If  the  discrete  communication  is  not  to,  from,  or  about  a  tasked 
selector  but  is  to  or  from  an  identifiable  U.S.  person,  or  a  person 
reasonably  believed  to  be  located  in  the  United  States,  the  NS  A  analyst 
will  document  that  determination  in  the  relevant  analytic  repository  or  tool 
if  technically  possible  or  reasonably  feasible.  Such  discrete 
communication  cannot  be  used  for  any  purpose  other  than  to  protect 
against  an  immediate  threat  to  human  life  (e.g.,  force  protection  or  hostage 
situations).  NSA  will  report  any  such  use  to  the  Office  of  the  Director  of 
National  Intelligence  and  to  the  National  Security  Division  of  the 
Department  of  Justice,  which  will  promptly  notify  the  Foreign  Intelligence 
Surveillance  Court  of  such  use. 

3 .  (TS/ZSk/NF)  An  NSA  analyst  seeking  to  use  a  discrete  communication  within 
an  Internet  transaction  that  contams  multiple  discrete  communications  in  a 
FISA  application,  intelligence  report,  or  section  702  targeting  must 
appropriately  document  the  verifications  required  by  subsections  3(b)(4)b.l. 
and  2.  above. 

4.  (TS/ZSk/NF)-  Notwithstanding  subsection  3(b)(4)b.  above,  NSA  may  use 
metadata  extracted  from  hitemet  transactions  acquired  on  or  after  October  31, 
2011,  that  are  not  identified  and  segi'egated  pursuant  to  subsection  3(b)(4)a. 
without  first  assessing  whether  the  metadata  was  extracted  from:  a)  a  discrete 
communication  as  to  which  the  sender  and  all  intended  recipients  are  located 
in  tlie  United  States;  orb)  a  discrete  communication  to,  from,  or  about  a 
tasked  selector.  Any  metadata  extracted  from  Internet  transactions  that  are  not 
identified  and  segregated  pursuant  to  subsection  3(b)(4)a.  above  will  be 
handled  in  accordance  with  the  applicable  provisions  of  these  procedures. 

Any  metadata  extracted  from  an  Internet  transaction  subsequently  detennined 
to  contain  a  discrete  commimication  as  to  which  the  sender  and  all  intended 
recipients  are  reasonably  believed  to  be  located  inside  the  United  States  shall 
be  destroyed  upon  recognition. 

(5)  (U)  Magnetic  tapes  or  other  storage  media  containing  communications  acquired 
pursuant  to  section  702  may  be  scanned  by  computer  to  identify  and  select 
communications  for  analysis.  Computer  selection  terms  used  for  scanning,  such  as 
telephone  numbers,  key  words  or  phrases,  or  other  discriminators,  will  be  limited  to 
those  selection  terms  reasonably  likely  to  return  foreign  intelligence  information. 
Identifiers  of  an  identifiable  U.S.  person  may  not  be  used  as  terms  to  identify  and 
select  for  analysis  any  Internet  communication  acquired  through  NS  A's  upstream 
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collection  techniques.  An}"^  use  of  United  States  person  identifiers  as  terms  to  identify 
and  select  communications  must  first  be  approved  in  accordance  with  NSA 
procedures.  NSA  will  maintain  records  of  all  United  States  person  identifiers 
approved  for  use  as  selection  teims.  The  Depaitment  of  Justice's  National  Security 
Division  and  the  Office  of  the  Director  of  National  Intelligence  will  conduct  oversigirt 
of  NSA's  activities  with  respect  to  United  States  persons  that  are  conducted  pursuant 
to  this  paragraph. 

(6)  (U)  Further  handling,  retention,  and  dissemination  of  foreign  communications  will  be 
made  in  accordance  with  Sections  4,  6,  7,  and  8  as  applicable,  below.  Further 
handling,  storage,  and  dissemination  of  inadvertently  acquired  domestic 
communications  will  be  made  in  accordance  with  Sections  4,  5,  and  8  below. 

(c)  (U)  Destruction  of  Raw  Data 

(1) -tS//S: _ 

communications  acquired  by  or  with  the  assistance  of  the  FBI  fi:om  Internet  Service 
Providers  that  do  not  meet  the  retention  standards  set  forth  in  tlrese  procedures  and 
that  are  known  to  contain  communications  of  or  concerning  United  States  persons 
will  be  destroyed  upon  recognition.  Telephony  communications  and  Internet 
communications  acquired  by  or  with  the  assistance  of  the  FBI  from  hitemet  Service 
Providers  may  not  be  retained  longer  than  five  years  from  the  expiration  date  of  the 
certification  authorizing  the  collection  unless  NSA  specifically  detennines  that  each 
such  communication  meets  the  retention  standards  in  these  procedures. 

(2)  (TS//SF/NF)  Internet  transactions  acquired  tlirougli  NSA's  upstream  collection  ■ 
techniques  that  do  not  contain  any  information  that  meets  the  retention  standards  set 
forth  in  these  procedures  and  that  are  known  to  contain  communications  of  or 
concerning  United  States  persons  will  be  destroyed  upon  recognition.  An  Internet 
transaction  may  not  be  retained  longer  than  two  years  from  the  expiration  date  of  the 
certification  authorizing  the  collection  unless  NSA  specifically  determines  that  at 
least  one  discrete  communication  within  the  Internet  transaction  meets  the  retention 
standards  in  these  procedures  and  that  each  discrete  communication  within  the 
transaction  either:  (a)  is  to,  from,  or  about  a  tasked  selector;  or  (b)  is  not  to,  from,  or 
about  a  tasked  selector  and  is  also  not  to  or  from  an  identifiable  United  States  person 
or  person  reasonably  believed  to  be  in  the  United  States.  The  Internet  transactions 
that  may  be  retained  include  those  that  were  acquired  because  of  limitations  on  NSA's 
ability  to  filter  communications.  Any  hitemet  commmiications  acquired  tlirough 
NSA's  upstream  collection  techniques  that  are  retained  in  accordance  with  this 
subsection  may  be  reviewed  and  handled  only  in  accordance  with  the  standards  set 
forth  above  in  subsection  3(b)(4)  of  these  procedures. 

(3) -(TS//SF/NF)  Any  Internet  transactions  acquired  through  NSA's  upstream  collection 
techniques  prior  to  October  31,  201 1,  will  be  destroyed  upon  recognition. 
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(4)  (S/I'-TF)  NSA  may  temporarily  retain  specific  section  702-acquired  infonnation  that 
would  otherwise  have  to  be  destroyed,  pursuant  to  section  3(a)-(c)  above,  if  the 
Department  of  Justice  advises  NSA  in  writing  that  such  information  is  subject  to  a 
preservation  obligation  in  pending  or  anticipated  administrative,  civil,  or  criminal 
litigation.  The  specific  information  to  be  retained  (including,  but  not  limited  to,  the 
target(s)  or  selector(s)  whose  unminimized  infonnation  must  be  preserved  and  the 
relevant  time  period  at  issue  in  the  litigation),  and  the  particulai-  litigation  for  which 
the  information  will  be  retained,  shall  be  identified  in  writing  by  the  Department  of 
Justice.  Personnel  not  working  on  the  particular  litigation  matter  shall  not  access  tlie 
unminimized  section  702-acquired  information  preserved  pursuant  to  a  written 
preservation  notice  fiom  the  Department  of  Justice  that  would  otherwise  have  been 
destroyed  pursuant  to  these  procedures.  Other  personnel  shall  only  access  the 
infonnation  being  retained  for  litigation-i'elated  reasons  on  a  case-by-case  basis  after 
consultation  with  the  Department  of  Justice.  The  Department  of  Justice  shall  notify 
NSA  in  writing  once  the  section  702-acquired  infonnation  is  no  longer  required  to  be 
preserved  for  such  litigation  matters,  and  then  NSA  shall  promptly  destroy  the  section 
702-acquired  infonnation  as  otherwise  required  by  these  procedures.  Circumstances 
could  arise  requiring  that  section  702-acquired  infoimation  subject  to  other 
destruction/age  off  requirements  in  these  procedures  (e.g..  Section  5)  be  retained 
because  it  is  subject  to  a  preservation  requirement.  In  such  cases  the  Government 
will  notify  the  Foreign  Intelligence  Surveillance  Court  and  seek  permission  to  retain 
the  material  as  appropriate  consistent  with  law.  Depending  on  the  nature,  scope  and 
complexity  of  a  particular  preservation  obligation,  m  certain  circumstances  it  may  be 
technically  infeasible  to  retain  certain  section  702-acquired  information.  Should  such 
circumstances  arise,  they  will  be  brought  to  the  attention  of  the  court  with  jurisdiction 
over  the  underlying  litigation  matter  for  resolution. 

(d)  (U)  Change  in  Target's  Location  or  Status 

(1)  (U//FOUQ)  In  the  event  that  NSA  reasonably  believes  that  a  target  is  located  outside 
the  United  States  and  subsequently  learns  that  the  person  is  inside  the  United  States, 
or  if  NSA  concludes  that  a  target  who  at  the  time  of  targeting  was  believed  to  be  a 
non-United  States  person  is  in  fact  a  United  States  person  at  the  time  of  acquisition, 
the  acquisition  from  tlrat  person  will  be  tenninated  without  delay. 

(2)  (U)  Any  communications  acquired  through  the  targeting  of  a  person  who  at  the  time 
of  targeting  was  reasonably  believed  to  be  located  outside  the  United  States  but  is  in 
fact  located  inside  the  United  States  at  the  time  such  communications  were  acquired, 
and  any  communications  acquired  by  targeting  a  pei'son  who  at  the  time  of  targeting 
was  believed  to  be  a  non-United  States  person  but  was  in  fact  a  United  States  person 
at  the  time  such  communications  were  acquired,  will  be  treated  as  domestic 
communications  mider  these  procedures. 

(e)  (S//NF)  In  tlie  event  that  NSA  seeks  to  use  any  information  acquired  pursuant  to  section 

nty  about  the  location  of  the  target  of  tlie 
cheeks  described  in  NSA’s  seetion  702 


702  during  a  tune  perio^whaUhere  is  uncertai 


aequisition  beeause  the 
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targeting  procedures  were  not  functioning  properly,  NSA  will  follow  its  internal 
procedures  for  detennining  whether  such  information  may  be  used  (including,  but  not 
limited  to,  in  FISA  applications,  section  702  targeting,  and  disseminations).  Except  as 
necessary  to  assess  location  under  this  provision,  NSA  may  not  use  or  disclose  any 
information  acquned  pursuant  to  section  702  during  such  time  period  unless  NSA 
determines,  based  on  the  totality  of  the  circumstances,  that  the  tai-get  is  reasonably 
believed  to  have  been  located  outside  the  United  States  at  the  time  the  information  was 
acquned.  If  NSA  determines  that  the  target  is  reasonably  believed  to  have  been  located 
inside  the  United  States  at  the  time  the  infonnation  was  acquired,  such  information  will 
not  be  used  and  will  be  promptly  destroyed. 

(U)  Section  4  -  Acquisition  and  Handling  -  Attorney-Client  Communications 

(U)  As  soon  as  it  becomes  apparent  that  a  cormnunication  is  between  a  person  who  is  kirown 
to  be  under  criminal  indictment  in  the  United  States  and  an  attorney  who  represents  that 
individual  in  the  matter  under  indictment  (or  someone  acting  on  behalf  of  the  attorney), 
monitoring  of  that  communication  will  cease  and  the  communication  will  be  identified  as  an 
attorney-client  communication  m  a  log  maintained  for  that  purpose.  The  relevant  portion  of 
the  communication  containing  that  conversation  will  be  segregated  and  the  National  Security 
Division  of  the  Department  of  Justice  will  be  notified  so  that  appropriate  procedures  may  be 
established  to  protect  such  communications  fi'om  review  or  use  in  any  criminal  prosecution, 
while  preserving  foreign  intelligence  infonnation  contained  thereui.  Additionally,  all 
proposed  disseminations  of  information  constituting  United  States  person  attorney-client 
privileged  communications  must  be  reviewed  by  the  NSA  Office  of  General  Counsel  prior  to 
dissemination, 

(U)  Section  5  -  Domestic  Communications 

(TS//SI//NF)  A  communication  identified  as  a  domestic  communication  (and,  if  applicable, 
the  Internet  transaction  in  wliich  it  is  contained)  will  be  promptly  destroyed  upon  recognition 
unless  the  Director  (or  Acting  Director)  of  NSA  specifically  determines,  in  writing  and  on  a 
coromunication-by-communication  basis,  that  the  sender  or  intended  recipient  of  tlie 
domestic  communication  had  been  properly  targeted  under  section  702  of  the  Act,  and  the 
domestic  communication  satisfies  one  or  more  of  the  following  conditions: 

(1)  (TS//SI//NF)  such  domestic  communication  is  reasonably  believed  to  contain 
significant  foreign  intelligence  information.  Such  domestic  communication  (and,  if 
applicable,  the  transaction  in  which  it  is  contauied)  may  be  retained,  handled,  and 
disseminated  in  accordance  with  these  procedures; 

(2)  (TS/ZSIZ/NF)  such  domestic  communication  does  not  contain  foreign  intelligence 
information  but  is  reasonably  believed  to  contain  evidence  of  a  crime  that  has  been,  is 
being,  or  is  about  to  be  committed.  Such  domestic  communication  may  be 
disseminated  (including  United  States  person  identities)  to  appropriate  Federal  law 
enforcement  authorities,  in  accordance  with  50  U.S.C.  §§  1806(b)  and  1825(c), 
Executive  Order  No.  12333,  and,  where  applicable,  the  crimes  reporting  procedures 
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set  out  in  the  August  1995  "Memorandum  of  Understanding:  Reporting  of 
Information  Concerning  Federal  Crimes,"  or  any  successor  docmnent.  Such  domestic 
communication  (and,  if  applicable,  the  transaction  in  wliich  it  is  contained)  may  be 
retained  by  NS  A  for  a  reasonable  period  of  time,  not  to  exceed  six  months  unless 
extended  in  writing  by  the  Attorney  General,  to  pennit  law  enforcement  agencies  to 
determine  whether  access  to  original  recordings  of  such  communication  is  required 
for  law  enforcement  purposes; 

(3)  (TS//SI//NF)  such  domestic  communication  is  reasonably  believed  to  contain 
technical  data  base  information,  as  defined  in  Section  2(j),  or  infonnation  necessary 
to  understand  or  assess  a  communications  security  vulnerability.  Such  domestic 
communication  maybe  provided  to  the  FBI  and/or  disseminated  to  other  elements  of 
the  United  States  Government.  Such  domestic  communication  (and,  if  applicable,  the 
transaction  in  which  it  is  contained)  may  be  retained  for  a  period  sufficient  to  allow  a 
thorough  exploitation  and  to  permit  access  to  data  that  is,  or  is  reasonably  believed 
likely  to  become,  relevant  to  a  current  or  future  foreign  intelligence  requirement. 
Sufficient  duration  may  vary  witli  the  nature  of  the  exploitation. 

a.  (U//^QUO)  In  the  context  of  a  cryptanalytic  effort,  maintenance  of  technical  data 
bases  requires  retention  of  all  communications  that  are  enciphered  or  reasonably 
believed  to  contain  secret  meaning,  and  sufficient  duration  may  consist  of  any 
period  of  time  during  which  encrypted  material  is  subject  to,  or  of  use  in, 
cryptanalysis. 

b.  the  case  of  communications  tliat  are  not 
enciphered  or  otherwise  reasonably  believed  to  contain  secret  meaning,  sufficient 
duration  is  five  years  from  expiration  date  of  the  certification  authorizing  the 
collection  for  telephony  communications  and  Internet  communications  acquired 
by  or  with  the  assistance  of  the  FBI  fi:om  Internet  Service  Providers,  and  two 
years  from  expiration  date  of  the  ceitification  authorizing  the  collection  for 
Internet  transactions  acquired  through  NSA's  upstream  collection  techniques, 
unless  the  Signal  Intelligence  Director,  NSA,  determines  in  writing  that  retention 
of  a  specific  communication  for  a  longer  period  is  required  to  respond  to 
authorized  foreign  intelligence  or  counterintelligence  requirements;  or 

(4)  (U//FQUO)  such  domestic  communication  contains  information  pertaining  to  an 
imminent  threat  of  serious  harm  to  life  or  property.  Such  information  may  be 
retained  and  disseminated  to  the  extent  reasonably  necessary  to  counter  such  threat. 

(S//NF)  Notwithstanding  the  above,  if  a  domestic  communication  indicates  that  a  target 
has  entered  the  United  States,  NSA  may  promptly  notify  the  FBI  of  that  fact,  as  well  as 
any  information  concerning  the  target's  location  that  is  contained  in  the  communication. 
NSA  may  also  use  information  derived  fi'om  domestic  communications  for  collection 
avoidance  purposes,  and  may  provide  such  infonnation  to  the  FBI  and  CIA  for  collection 
avoidance  purposes.  NSA  may  retain  the  communication  from  which  such  infonnation  is 
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derived  but  shall  restrict  the  further  use  or  dissemination  of  the  communication  by 
placing  it  on  the  Master  Pm'ge  List  (MPL). 

(U)  Section  6  -  Foreign  Communications  of  or  Concerning  United  States  Persons 
(a)  (U)  Retention 

(U)  Foreign  communications  of  or  concerning  United  States  persons  collected  in  the  course 
of  an  acquisition  authorized  under  section  702  of  the  Act  may  be  retained  only: 

(1)  (U)  if  necessary  for  the  maintenance  of  technical  data  bases.  Retention  for  this 
purpose  is  permitted  for  a  period  sufficient  to  allow  a  thorough  exploitation  and  to 
permit  access  to  data  that  are,  or  are  reasonably  believed  likely  to  become,  relevant  to 
a  current  or  future  foreign  intelligence  requirement.  Sufficient  duration  may  vary 
with  the  nature  of  the  exploitation. 

a.  (U)  In  the  context  of  a  cryptanalytic  effort,  maintenance  of  technical  data  bases 
requires  retention  of  all  communications  that  are  enciphered  or  reasonably 
believed  to  contain  secret  meaning,  and  sufficient  duration  may  consist  of  any 
period  of  time  during  which  encrypted  material  is  subject  to,  or  of  use  in, 
cryptanalysis. 

b.  (TS//SF/NF)  In  the  case  of  communications  that  are  not  enciphered  or  otherwise 
reasonably  believed  to  contain  secret  meaning,  sufficient  duration  is  five  years 
from  expiration  date  of  the  certification  authorizing  the  collection  for  telephony 
communications  and  Internet  communications  acquired  by  or  with  the  assistance 
of  the  FBI  from  Internet  Service  Providers,  and  two  years  fi'om  expiration  date  of 
the  certification  authorizing  the  collection  for  Internet  transactions  acquired 
through  NSA's  upstream  collection  techniques,  unless  the  Signals  Intelligence 
Director,  NS  A,  determines  in  writing  that  retention  of  a  specific  category  of 
communications  for  a  longer  period  is  required  to  respond  to  authorized  foreign 
intelHgence  or  counterintelligence  requirements; 

(2)  (U)  if  dissemination  of  such  communications  with  i-eference  to  such  United  States 
persons  would  be  permitted  under  subsection  (b)  below;  or 

(3)  (U)  if  the  information  is  evidence  of  a  crime  that  has  been,  is  being,  or  is  about  to  be 
committed  and  is  provided  to  appropriate  federal  law  enforcement  authorities. 

(TS//SI//NF)  Forei^  communications  of  or  concerning  United  States  persons  that  may 
be  retained  under  subsections  6(a)(2)  and  (3)  above  include  discrete  communications 
contained  in  Internet  transactions,  provided  that  NS  A  has  specifically  determined, 
consistent  with  subsection  3(c)(2)  above,  that  each  discrete  communication  within  the 
Internet  transaction  either:  (a)  is  to,  from,  or  about  a  tasked  selector;  or  (b)  is  not  to,  from, 
or  about  a  tasked  selector  and  is  also  not  to  or  from  an  identifiable  United  States  person 
or  person  reasonably  believed  to  be  in  the  United  States. 
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(b)  (U)  Dissemination 

(U)  A  dissemination  based  on  communications  of  or  concerning  a  United  States  person  may 
be  made  in  accordance  with  Section  7  or  8  below  if  the  identity  of  the  United  States  person  is 
deleted  and  a  generic  teiin  or  s3nnbol  is  substituted  so  that  the  information  cannot  reasonably 
be  connected  with  an  identifiable  United  States  person.  Otherwise,  dissemination  of 
intelligence  based  on  communications  of  or  concerning  a  United  States  person  may  only  be 
made  to  a  recipient  requiring  the  identity  of  such  person  for  the  performance  of  official  duties 
but  only  if  at  least  one  of  the  following  criteria  is  also  met: 

(1)  (U)  tlie  United  States  person  has  consented  to  dissemination  or  the  infonnation  of  or 
concerning  the  United  States  person  is  available  publicly; 

(2)  (U)  the  identity  of  the  United  States  person  is  necessary  to  understand  foreign 
intelligence  information  or  assess  its  importance,  e.g.,  the  identity  of  a  senior  official 
in  the  Executive  Branch; 

(3)  (U)  the  conununication  or  information  indicates  that  the  Urdted  States  person  may  be: 

a.  an  agent  of  a  foreign  power; 

b.  a  foreign  power  as  defined  in  section  101(a)  of  the  Act; 

c.  residing  outside  the  United  States  and  holding  an  official  position  in  the 
government  or  military  forces  of  a  foreign  power; 

d.  a  coiporation  or  other  entity  that  is  owned  or  controlled  directly  or  indirectly  by  a 
foreign  power;  or 

e.  acting  in  collaboration  with  an  intelligence  or  security  service  of  a  foreign  power 
and  the  United  States  person  has,  or  has  had,  access  to  classified  national  security 
information  or  material; 

(4)  (U)  the  communication  or  information  indicates  that  the  United  States  person  may  be 
the  target  of  intelligence  activities  of  a  foreign  power; 

(5)  (U)  the  communication  or  infonnation  indicates  that  the  United  States  person  is 
engaged  in  the  unauthorized  diselosure  of  classified  national  security  information  or 
the  United  States  person's  identity  is  necessary  to  understand  or  assess  a 
communications  or  network  security  vulnerability,  but  only  after  the  agency  that 
originated  the  information  certifies  that  it  is  properly  classified; 

(6)  (U)  the  communication  or  information  indicates  that  the  United  States  person  may  be 
engaging  in  international  terrorist  activities; 
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(7)  (U//FOUQ)  the  acquisition  of  the  United  States  person's  communication  was 
authorized  by  a  court  order  issued  pursuant  to  the  Act  and  the  communication  may 
relate  to  the  foreign  intelligence  purpose  of  the  suiweillance;  or 

(8)  (U)  the  communication  or  information  is  reasonably  believed  to  contain  evidence  that 
a  crime  has  been,  is  being,  or  is  about  to  be  committed,  provided  that  dissemination  is 
for  law  enforcement  purposes  and  is  made  in  accordance  with  50  U.S.C.  §§  1 806(b) 
and  1825(c),  Executive  Order  No.  12333,  and,  where  applicable,  the  crimes  reporting 
procedures  set  out  in  the  August  1995  "Memorandmn  of  Understanding:  Reporting  of 
Information  Concerning  Federal  Grumes,"  or  any  successor  document. 

(c)  (U)  Provision  of  Unminimized  Communications  to  CIA  and  FBI 

(1)  (U)  NSA  may  provide  to  the  Central  Intelligence  Agency  (CIA)  unminimized 
communications  acquired  pursuant  to  section  702  of  the  Act.  CIA  will 
identify  to  NSA  targets  for  which  NSA  may  provide  umninimized 
communications  to  CIA.  CIA  will  handle  any  such  umminunized 
communications  received  from  NSA  in  accordance  with  CIA  minimization 
procedui'es  adopted  by  the  Attorney  General,  in  consultation  with  the  Director 
of  National  Intelligence,  pursuant  to  subsection  702(e)  of  the  Act. 

(2)  (U)  NSA  may  provide  to  the  FBI  unminimized  communications  acquired  pursuant  to 
section  702  of  the  Act.  The  FBI  will  identify  to  NSA  targets  for  which  NSA  may 
provide  unminimized  communications  to  the  FBI.  The  FBI  will  handle  any  such 
unminimized  communications  received  from  NSA  in  accordance  with  FBI 
minimization  procedures  adopted  by  tire  Attorney  General,  in  consultation  with  the 
Director  of  National  Intelligence,  pursuant  to  subsection  702(e)  of  the  Act. 

(U)  Section  7  -  Other  Foreign  Communications 

(U)  Foreign  communications  of  or  concerning  a  non-United  States  person  may  be  retained, 
used,  and  disseminated  in  any  form  in  accordance  witli  other  applicable  law,  regulation,  and 
policy. 


communications  of  or  concerning  a  non-United  States  person  drat  may 


be  retained  under  this  subsection  include  discrete  communications  contamed  in  Internet 
transactions,  provided  that  NSA  has  specifically  detennined,  consistent  with  subsection 
3(c)(2)  above,  that  each  discrete  communication  within  the  Internet  transaction  either:  (a)  is 
to,  from,  or  about  a  tasked  selector;  or  (b)  is  not  to,  from,  or  about  a  tasked  selector  and  is 
also  not  to  or  from  an  identifiable  United  States  person  or  person  reasonably  believed  to  be  in 
the  United  States. 

(U//FOUO)-  Additionally,  foreign  communications  of  or  concerning  a  non-United  States 
person  may  be  retained  for  the  same  purposes  and  in  the  same  manner  as  detailed  in  Section 
6(a)(1),  above. 
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(U)  Section  8  -  Collaboration  with  Foreign  Governments 

(a)  (U)  Procedures  for  the  dissemination  of  evaluated  and  minimized  information.  Pursuant 
to  section  1.7(c)(8)  of  Executive  Order  No.  12333,  as  amended,  NSA  conducts  foreign 
cryptologic  liaison  relationships  with  certain  foreign  governments.  Information  acquired 
pursuant  to  section  702  of  the  Act  may  be  disseminated  to  a  foreign  government.  Except 
as  provided  below  in  subsection  8(b)  of  these  procedures,  any  dissemination  to  a  foreign 
government  of  information  of  or  concerning  a  United  States  person  that  is  acquired 
pursuant  to  section  702  may  only  be  done  in  a  manner  consistent  with  sections  6(b)  and  7 
of  these  NSA  minimization  procedures. 

(b)  (U)  Procedures  for  technical  or  linguistic  assistance.  It  is  anticipated  that  NSA  may 
obtain  information  or  communications  that,  because  of  their  technical  or  linguistic 
content,  may  require  further  analysis  by  foreign  governments  to  assist  NSA  in 
determining  their  meaning  or  significance.  Notwithstanding  other  provisions  of  these 
minimization  procedures,  NSA  may  disseminate  computer  disks,  tape  recordings, 
transcripts,  or  other  information  or  items  containing  unmirrimized  infonnation  or 
communications  acquired  pursuant  to  section  702  to  foreign  governments  for  further 
processing  and  analysis,  under  the  following  restrictions  with  respect  to  any  materials  so 
disseminated; 

(1)  (U)  Dissemination  to  foreign  governments  will  be  solely  for  trairslation  or 
analysis  of  such  infonnation  or  communications,  and  assisting  foreign 
governments  will  make  no  use  of  any  information  or  any  communication  of  or 
concerning  any  person  except  to  provide  technical  and  linguistic  assistance  to 
NSA. 

(2)  (U)  Dissemination  will  be  only  to  those  persoimel  within  foreign  goveimnents 
involved  in  the  translation  or  analysis  of  such  information  or  communications. 

The  number  of  such  personnel  will  be  restricted  to  the  extent  feasible.  There 
will  be  no  dissemination  within  foreign  governments  of  this  umninimized  data. 

(3)  (U)  Foreign  govermnents  will  malce  no  permanent  agency  record  of 
information  or  communications  of  or  concerning  any  person  refened  to  or 
recorded  on  computer  disks,  tape  recordings,  transcripts,  or  other  items 
disseminated  by  NSA  to  foreign  governments,  provided  that  foreign 
governments  may  maintain  such  temporary  records  as  are  necessary  to  enable 
them  to  assist  NSA  with  the  translation  or  analysis  of  such  information. 

Records  maintained  by  foreign  governments  for  this  purpose  may  not  be 
disseminated  within  the  foreign  governments,  except  to  persoimel  involved  in 
providing  technical  or  linguistic  assistance  to  NSA. 

(4)  (U)  Upon  the  conclusion  of  such  technical  or  linguistic  assistance  to  NSA, 
computer  disks,  tape  recordings,  transcripts,  or  other  items  or  information 
disseminated  to  foreign  governments  will  either  be  rehmued  to  NSA  or  be 
destroyed  with  an  accounting  of  such  destruction  made  to  NSA. 
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(5)  (U)  Any  information  tliat  foreign  governments  provide  to  NS  A  as  a  result  of 
such  technical  or  linguistic  assistance  may  he  disseminated  by  NSA  in 
accordance  with  these  minimization  procedures. 
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EXHIBIT  A  ^ 

PROCEDURES  USED  BY  THE  NATIONAL  SECURITY  AGENCY  FO^‘Ti«MG^nKC  3; 
NON-UNTTED  STATES  PERSONS  REASONABLY  BELIEVED  TOB^LLOCATED 
OUTSIDE  THE  UNITED  STATES  TO  ACQUIRE  FOREIGN  INTEI^^fe^<£jriVH  H/ 
INFORMATION  PURSUANT  TO  SECTION  702  OF  THE  FOREIGN  INTEL^ilGENCEj.f? 
SURVEILLANCE  ACT  OF  1978,  AS  AMENDED 

(S)  These  procedures  address:  (I)  the  manner  in  which  the  National  Security  Agency/Central 
Security  Service  (NS  A)  will  detennine  that  a  person  targeted  under  section  702  of  the  Foreign 
Intelligence  Surveillance  Act  of  1978,  as  amended  (FISA  or  "the  Act"),  is  a  non-United  States 
person  reasonably  believed  to  be  located  outside  the  United  States  ("foreignness  determination"); 
(II)  the  post-targeting  analysis  done  by  NS  A  to  ensure  that  the  targeting  of  such  person  does  not 
intentionally  target  a  person  known  at  the  time  of  acquisition  to  be  located  in  the  United  States 
and  does  not  result  in  the  intentional  acquisition  of  any  communication  as  to  which  the  sender 
and  aU  intended  recipients  are  known  at  the  time  of  acquisition  to  be  located  in  the  United  States; 
(HI)  the  documentation  of  NSA's  foreigmiess  determination;  (IV)  compliance  and  oversight;  and 
(V)  departures  from  these  procedures. 

I.  (S)  DETERMINATION  OF  WHETHER  THE  ACQUISITION  TARGETS  NON- 
UNTTED  STATES  PERSONS  REASONABLY  BELIEVED  TO  BE  LOCATED  OUTSIDE 
THE  UNITED  STATES 


(S)  NSA  determines  whether  a  person  is  a  non-United  States  person  reasonably  believed  to  be 
outside  the  United  States  in  light  of  the  totality  of  the  circumstances  based  on  the  infonnation 


(S)  NSA  analysts  examine  the  following  three  categories  of  information,  as  appropriate  under  the 
circumstances,  to  make  the  above  detennination:  (1)  they  examine  the  lead  information  they 
have  received  regarding  the  potential  target  or  the  facility  that  has  generated  interest  in 


location  of  the  person,  or  knows  information  that  would  provide  evidence  concerning  that 
location;  and  (3)  they  conductHH^^^^^^^^^H^^^^^^^Ito  determine  or  verify 
mformatioh  about  the  person's  location.  NSA  may  use  information  from  any  one  or  a 
combination  of  these  categories  of  information  in  evaluating  the  totality  of  the  circumstances  to 
determine  that  the  potential  target  is  located  outside  the  United  States.  _ 
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(TS//SI)  In  addition,  in  those  cases  where  NSA  seeks  to  acquire  communications  about  the  target 
that  are  not  to  or  from  the  target,  NSA  will  either  employ  an  Internet  Protocol  filter  to  ensure  that 
the  person  from  whom  it  seeks  to  obtain  foreign  intelligence  information  is  located  overseas,  or  J 

in  ns  a  win  direct 

surveillance  at  a  party  to  the  commmiication  reasonably  believed  to  be  outside  the  United  States. 


(S)  Lead  Information 


(S)  When  NSA  proposes  to  direct  surveillance  at  a  target,  it  does  so  because  NSA  has  already 
learned  something  about  the  target  or  the  facility  or  facilities  die  target  uses  to  communicate. 
Accordingly,  NSA  will  examine  the  lead  information  to  determine  what  it  reveals  about  the 
physical  location  of  the  target,  including  f 


(S)  TTie  following  are  examples  of  the  types  of  lead  information  that  NSA  may  examine: 


(S)  Information  NSA  Has  About  the  Target's  Location  and/or  Facility  or  Facilities  Used  by 
the  Target 


NSA  may.  also  review  information  in  its  databases,  including  repositories  of  information 
collected  by  NSA  and  by  other  intelligence  agencies  to 

determine  if  die  person's  location,  or  information  providing  evidence  about  the  person’s  location, 
is  already  known.  The  NSA  databases  diat  would  be  used  for  this  purpose  contain  information 
culled  from  signals  intelligence,  human  intelligence,  law  enforcement  information,  and  other 
sources.  For  example. 
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^  Assessment  of  the  Non-United  States  Person  Status  of  the  Target 


(S)  In  many  cases,  the  information  that  NSA  examines  in  order  to  determine  whether  a  target  is 
reasonably  believed  to  be  located  outside  the  United  States  may  also  bear  upon  the  non-United 
States  person  status  of  that  target.  For  example,! 


similarly, 

information  contained  in  NSA  databases,  including  repositori^  of  information  collected  by  NSA 
and  by  other  intelligence  agencies,  may  indicate  that  the  target  is  a  non-United  States  person. 
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Assessment  of  the  Foreign  Intelligence  Purpose  of  the  Targeting 


In  assessing  whether  the  target  possesses,  is  expected  to  receive,  and/or  is  likely  to 
nmunicate  foreign  intelHgence  information  concerning  a  foreign  power  or  foreign  territory, 
NSA  considers,  among  other  things,  the  following  factors: 


a.  With  respect  to  telephone  communications: 
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b. .  With  respect  to  Internet  communications: 
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n.-^  POST-TARGETING  ANALYSIS  BY  NSA 

(S//SI)  After  a  person  has  been  targeted  for  acquisition  by  NSA,  NSA  will  conduct  post-targeting 
analysis.  Such  analysis  is  designed  to  detect  those  occasions  when  a  person  who  whdi  targeted 
was  reasonably  believed  to  be  located  outside  the  United  States  has  since  entered  the  United 
States,  and  will  enable  NSA  to  take  steps  to  prevent  the  intentional  acquisition  of  any 
communication  as  to  which  the  sender  and  all  intended  recipients  are  known  at  the  time  of 
acquisition  to  be  located  in  the  United  States,  or  the  intentional  targeting  of  a  person  who  is 
inside  the  United  States.  Such  analysis  may  include: 


a)  (S)  For  telephone  numbers: 


•  NSA  analysts  may  analyze  content  for  indications  that  a  foreign  target  has  entered  or 
intends  to  enter  the  United  States.  Such  content  analysis  will  be  conducted  according  to 
analytic  and  intelligence  requirements  and  priorities. 
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•  NSA  analysts  may  analyze  content  for  indications  that  a  target  has  entered  or  intends  to 
enter  the  United  States.  Such  content  analysis  will  be  conducted  according  to  analytic 
and  intelligence  requirements  and  priorities.^ 

(S)  If  NSA  determines  that  a  target  has  entered  the  United  States,  it  will  follow  the  procedures 
set  forth  in  section  IV  of  this  document,  including  the  termination  of  the  acquisition  from  the 


NSA  analysts  will  also  analyze  content  for  indications  that  a  target  is  a  United  States  person.^ 
Such  content  analysis  wiU  be  conducted  according  to  analytic  and  intelligence  requirements  and 
priorities.  If  NSA  determines  that  a  target  who  at  the  time  of  targeting  was  believed  to  be  a  non- 
United  States  person  is  believed  to  be  a  United  States  person,  it  will  follow  the  procedures  set 
forth  in  section  IV  of  this  document,  including  the  termination  of  the  acquisition  from  the  target 
without  delay. 

m.  (S)  DOCUMENTATION 

(S)  Analysts  who  request  tasking  will  document  in  the  tasking  database  a  citation  or  citations  to 
the  information  that  led  them  to  reasonably  believe  that  a  targeted  person  is  located  outside  the 
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United  States.  Before  tasking  is  approved,  tlie  database  entry  for  that  tasking  will  be  reviewed  in 
order  to  verify  that  the  database  entry  contains  the  necessary  citations. 


(S)  A  citation  is  a  reference  that  identifies  the  source  of  tlie  information, 

The  citation  enable  those 

responsible  for  conducting  oversight  to  locate  and  review  the  information  that  led  NS  A  analysts 
to  conclude  that  a  target  is  reasonably  believed  to  be  located  outside  the  United  States. 


(S)  Analysts  also  will  identify  the  foreign  power  or  foreign  territory  about  which  they  expect  to 
obtain  foreign  intelhgence  information  pursuant  to  the  proposed  targeting. 

IV.  (S)  OVERSIGHT  AND  COMPLIANCE 


(S)  NSA  will  implement  a  compliance  program,  and  will  conduct  ongoing  oversight,  with 
respect  to  its  exercise  of  the  authority  xmder  section  702  of  the  Act,  including  the  associated 
targeting  and  minimization  procedures  adopted  in  accordance  witli  section  702.  NSA  will 
develop  and  deliver  training  regarding  the  applicable  procedures  to  ensure  intelligence  personnel 
responsible  for  approving  the  targeting  of  persons  under  these  procedures,  as  well  as  analysts 
with  access  to  the  acquired  foreign  intelligence  information  understand  their  responsibilities  and 
the  procedures  that  apply  to  this  acquisition.  NSA  has  estabhshed  processes  for  ensuring  that 
raw  traffic  is  labeled  and  stored  only  in  authorized  repositories,  and  is  accessible  only  to  those 
who  have  had  the  proper  training.  NSA  will  conduct  ongoing  oversight  activities  and  wiU  make 
any  necessary  reports,  including  those  relating  to  incidents  of  noncompliance,  to  the  NSA 
Inspector  General  and  OGC,  in  accordance  with  its  NSA  charter.  NSA  will  also  ensure  that 
necessary  corrective  actions  are  taken  to  address  any  identified  deficiencies.  To  that  end,  NSA 
will  conduct  periodic  spot  checks  of  targeting  decisions  and  intelligence  disseminations  to  ensure 
compliance  with  established  procedures,  and  conduct  periodic  spot  checks  of  queries  in  data 
repositories. 


(S)  The  Department  of  Justice  (DOJ)  and  the  Office  of  the  Director  of  National  Intelligence 
(ODNI)  will  conduct  oversight  of  NSA's  exercise  of  tire  authority  rmder  section  702  of  the  Act, 
which  will  include  periodic  reviews  by  DOJ  and  ODNI  personnel  to  evaluate  the  implementation 
of  the  procedures.  Such  reviews  wUl  occur  approximately  once  every  two  months. 

(S)  NSA  will  report  to  DOJ,  to  the  ODNI  Office  of  General  Counsel,  and  to  the  ODNI  Civil 
Liberties  Protection  Officer  any  incidents  of  noncompliance  with  these  procedures  by  NSA 
personnel  that  result  in  the  intentional  tar  geting  of  a  person  reasonably  believed  to  be  located  in 
the  United  States,  the  intentional  targeting  of  a  United  States  person,  or  the  intentional 
acquisition  of  any  communication  in  which  the  sender  and  all  intended  recipients  are  known  at 
the  time  of  acquisition  to  be  located  within  the  United  States.  NSA  wiU  provide  such  reports 
within  five  business  days  of  learning  of  the  incident.  Any  information  acquired  by  intentionally 
targeting  a  United  States  person  or  a  person  not  reasonably  believed  to  be  outside  the  United 
States  at  the  time  of  such  targeting  will  be  purged  fi:om  NSA  databases. 


(S)  NSA  wUl  report  to  DOJ  through  the  Deputy  Assistant  Attorney  General  in  the  National 
Security  Dhdsion  with  responsibiUty  for  inteUigence  operations  and  oversight,  to  the  ODNI 
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Office  of  General  Counsel,  and  to  the  ODNl  Civil  Liberties  Protection  Officer,  any  incidents  of 
noncompliance  (including  overcollection)  by  any  electronic  comimmication  service  provider  to 
whom  the  Attorney  General  and  Director  of  National  IntelUgence  issued  a  directive  under , 
section  702.  Such  report  will  be  made  within  five  business  days  after  determining  that  the 
electronic  communication  service  provider  has  not  comphed  or  does  not  intend  to  comply  with  a 
directive. 


(S)  In  the  event  that  NSA  concludes  fbat  a  person  is  reasonably  beUeved  to  be  located  outside  the 
United  States  and  after  targeting  this  person  learns  that  the  person  is  inside  the  United  States,  or 
if  NSA  concludes  that  a  person  who  at  the  time  of  targeting  was  believed  to  be  a  non-United 
States  person  is  believed,  to  be  a  United  States  person,  it  will  take  the  following  steps: 

1)  Terminate  the  acquisition  without  delay  and  determine  whether  to  seek  a  Court  order 
under  another  section  of  the  Act.  If  NSA  inadvertently  acquires  a  commxmication 
sent  to  or  from  the  target  while  the  target  is  or  was  located  inside  the  United  States, 
including  any  communication  where  the  sender  and  all  intended  recipients  are 
reasonably  believed  to  be  located  inside  the  United  States  at  the  time  of  acquisition, 
such  communication  will  be  treated  m  accordance  with  the  applicable  minimization 
procedures. 

2)  Report  the  incident  to  DOJ  through  the  Deputy  Assistant  Attorney  General  in  the 
National  Security  Division  with  responsibihty  for  inteUigence  operations  and 
oversight,  to  the  ODNI  Office  of  General  Counsel,  and  to  the  ODNI  Civil  Liberties 
Protection  Officer  within  five  business  days. 

V.  (S)  DEPARTURE  FROM  PROCEDURES 


(S)  If,  in  order  to  protect  against  an  immediate  threat  to  the  national  security,  NSA  determines 
that  it  must  take  action,  on  a  temporary  basis,  in  apparent  departure  from  these  procedures  and 
that  it  is  not  feasible  to  obtain  a  timely  modification  of  these  procedures  firom  tlie  Attorney 
General  and  Duector  of  National  Intelligence,  NSA  may  take  such  action  and  will  report  tliat 
activity  promptly  to  DOJ  through  the  Deputy  Assistant  Attorney  General  in  the  National  Security 
Division  witli  responsibility  for  intelligence  operations  and  oversight,  to  the  ODNI  Office  of 
General  Counsel,  and  to  the  ODNI  Civil  Liberties  Protection  Officer.  Under  such  circumstances, 
the  Government  will  continue  to  adhere  to  all  of  the  statutory  limitations  set  forth  in  subsection 
702(b)  of  the  Act. 
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(b)(7)(C)  ^HIDMOj;  (b)(7)(C) 

THE  COURT :  Then  we ' : 

^SU3a(b)(6);  (b)(7)(C) 

^ _ 

FBI 

FBI. 

m^^m,  FBI  Office  of  General  ^ 

^Hi 

H' 

^^■-#r-oin  -NSA-Gener-a-l-  Courts  el-i-S— - 1 

FBI 

FBI. 

FBI  Office  of  General 
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THE  COURT:  And  especially  those  in  the  back,  please 
speak  up  so  the  court  reporter  can  hear  you  and  the  little  mic 
can  pick  up.  So  that  was and  this 

the  FISA  technical  lead 

from  Oversight  and  Compliance  at  NSA. 

THE  COURT:  Thank  you.  Yes,  ma'am. 

here  on 

the  Director  of  National  Intelligence,  Office  of  General 
Counsel . 


from  NSA/OGC . 
from  NSA. 

from  the  Office  of 


I’m 

General  Counsel  for  CIA. 

THE  COURT:  Very  good.  And  why  don't  we  have  our 
staff  introduce  themselves  as  well. 


P(6) 


THE  COURT:  All  right.  Thank  you. 

Now  I  Vv/ould  like  to  swear  in  the  nonlawyers  who  may  be 
speaking  today.  Whoever  that  consists  of,  do  you  want  to  rise? 
I'll  do  it  all  at  one  time.  All  right. 

(The  witnesses  are  sworn.) 

THE  COURT:  Well,  let  me  stare  for  the  record  why 
we're  here,  although  I  think  we  all  do  know  why  we're  here. 


■TOP  S ECRBT  /  /  COMINT /  /  ORCQN , 
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The  purpose  of  today's  hearing  is  for  the  Court  to  receive 
additional  information  and/or  clarification  with  respect  to  its 
judicial  review  under  section  702 (i)  of  the  FISA  Amendments  Act 
of  2008. 

The  Court,  of  course,  did  receive  from  the  government  on 
August  5,  2008,  an  ex  parte  submission  entitled  "Government's  Ex 
Parte  Submission  of  and  Related 

Procedures  and  Requests  for  an  Order  Approving  Such 
Certification  and  Procedures . " 

At  that  point,  the  Court  reviewed  the  submission,  as  the 
staff  did,  and  after  that  the  staff  met  with  certain  members  of 
the  government  and  relayed  my  questions  and  their  questions  to 
the  government.  We  then  received  yesterday,  August  26,  a 
document  entitled  "Government's  Preliminary  Responses  to  Certain 
Questions  Posed  By  the  Court." 

That  was  very  helpful  to  get  that,  and  I  know  you  must  have 
had  to  work  hard  to  put  it  together  on  such  short  notice.  So  I 
appreciate  it,  and  it  was  very  helpful. 

What  I'd  like  to  do  today  is  go  over  some  questions  that  I 
still  have.  I  think  your  written  response  answered  --  the 
questions  that  you  did  deal  v/ith  I  think  were  answered 
completely,  and  I  probably  won't  be  doing  too  much  with  them. 

I  may  just  want  to  confirm  a  couple  of  things . 

Then  I  have  some  additional  questions  that  I  think  probably 
you're  prepared  for  because  the  staff  raised  them,  but  I  didn't 


^DP  CTT-rngm  t  /cnMTMm  !  /m?pmT  wni^np-ta . 
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see  them  in  your  responses .  Okay? 

All  right.  Let  me  just  start  with,  again,  this  first 
couple  things  I'm  doing  relates  to  v^/hat  you  filed  yesterday,  and 
again  it's  just  to  sort  of  pinpoint  a  couple  of  things  on  page  5 
of  yesterday's  submission  where  you  were  responding  to  my 


And  you  did  a  lengthy  response  to  that,  and  I  appreciated  it, 
and  I  just  want  to  sort  of  confirm  and  hone  in  on  the  fact  that 
it  is  going  to  be  a  situation  where  you're  all  going  to  try  -- 
they're  going  to  try  to  figure  out  whether  this  person  is  a  U.S. 
person.  That  was  the  only  issue  I  had,  was  what's  the  due 
diligence  that  will  go  on. 

And  especially  I'm  impressed  with  the  second  bullet  point 


■gp&p .  SECRBff  /  /  COMINT  /  /  ORCQM , 
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It's  my  understanding  --  and, 
correct  me  if  I'm  wrong  --  NSA  analysts  track  particular 
targets.  So  it  is  the  analyst  who  determines  the  extent  to 
which  they  need  to  rely  on  content  analysis  to  determine  a 
target's  location  as  opposed  to  something  more 

the  analyst's 

responsibility  for  maintaining  a  reasonable  belief  that  that 
target  is  located  outside  the  United  States. 

And  I  don't  know  if  you'd  like  to  elaborate  on  that, 

That's  correct,  and  every  selector  that 
goes  into  an  NSA  database  has  an  analyst's  name 

identified  with  that  so  we  know  who  bears  the  ultimate 
responsibility,  and  we  have  processes  set  up  in  place  to  ensure 
they're  doing  their  work. 

THE  COURT:  Could  you  just  do  a  minute  or  two  on  the 

processes? 

Yes,  ma'am.  How  far  back  should  I  start? 

THE  COURT:  I  don't  Icnow  what  that  means,  "how  far 
back,"  but  just  hone  in  on  the  fact  that  they're  responsible  for 
following  their  target's  locations;  in  other  words,  for 
following  it  and  the  validity  of  the  continued  acquisition.  So 
having  made  the  initial  foreignness  determination,  how  do  you  go 
about  making  sure  they  are  remaining  responsible? 

The  first  thing  they  would  do,  they  would 
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information,  the  first  thing  they  would  be  responsible  for  would 
be  to  review  the  content  of  that  information  to  ensure  they  got 
the  right  target  and  that  it  was  providing  foreign  intelligence. 


Once  they  do  that,  they're  going  to  periodically  check  that 


reviewed  that  target  and  that  it  is  meeting  a  foreign 
intelligence  purpose. 


THE  COURT:  Okay.  Any  of  the  staff  have. any  questions 
on  that  topic  before  I  move  away  from  it? 

All  right.  Now,  this  next  one  relates  to  an  issue  that 
came  up  at  the  December  ' 07  hearing  before  Judge  Kotelly  on  the 
Protect  America  Act,  and  it  relates  to  oversight  reviews. 

Obviously,  the  targeting  procedures  that  we're  talking 
about  now,  at  least  with  respect  to  the  location  of  potential 
targets,  are  similar  to  what  was  reviewed  by  Judge  Kotelly  and  . 
requires  oversight  reviews  by  personnel  of  Justice  and  the 
Office  of  the  Director  of  National  Intelligence. 

I  read  the  transcript  of  the  hearing  before  Judge  Kotelly, 
and’“she“Eo6k"^“ldt“ ’of' Testimony  concerning  the"  oversight  up  to 
that  point.  Can  somebody  fill  me  in  on  where  we  are  today  on 


16-CV-8936  (RMB)  000381 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1081  of  1298 

All  withheld  information  exempt  under  (btn’V]apd/q^(i?y^,gtlp^  PRCON  ,  NO for  Public  Release 


9 


that?  Has  the  methodology  that's  been  used  by  the  reviewers 
changed  at  all?  Could  somebody  summarize  the  results  of  those 
reviews? 

The  methodology  has  been  changed.  It's 
been  refined.  Back  in  December,  because  of  the  voliome  of 
selectors  and  because  we  hadn't  worked  through  an  exact  process 
in  how  we  would  conduct  our  oversight,  we  weren't  in  a  position 
to  be  able  to  review  every  single  tasking  decision  that  the  NSA 
had  made . 

We  would  do  it  on  a  sampling  basis .  Sometimes  we  randomly 
picked  certain  days  and  we  would  look  at  tasking  decisions  for 
those  days,  or  if  we  had  a  range  of  selectors  that  had  been 
tasked,  we  would  randomly  select  the  sources  of  information  upon 
which  the  foreignness  determinations  for  those  particular 
selectors  were  based. 

Since  then,  we've  refined  our  process  such  that  we're 
actually  able  to  at  the  very  least  receive  all  of  the 
documentation  concerning  every  single  tasking  decision  that  NSA 
has  made.  Typically,  they're  sent  to  us  in  electronic  format. 

So  we  receive  those,  we  print  them  off,  and  we  review  them 
to  make  sure  that  all  of  the  documentation  that  the  targeting 
procedures  require  is  present,  that  being  a  notation  about  the 
foreign  intelligence  purpose  of  the  collection  and  the  source  of 
the  information  upon  which  the  foreignness  determination  for 
that  particular  selector  was  based. 


,(6:.  lt<7)iCj 
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A&  we've  gone  on  and  we've  refined  our  methodology  and 
we've  had  back- and- forth  with  NSA  over  how  we  can  improve  their 
performance  v^ith  respect  to  filling  out  particular  fields  in  the 
sheets,  as  a  result  of  that  back-and-f orth,  we've  actually  had 
to  review  less  and  less  sources  because  NSA  is  relying  more  and 
more  on  don't  necessarily  need  to  review  per  se. 

I  mean,  the  most  common  source  of  information  that  NSA 


So  I  guess  in  a  nutshell,  we've  been  able  to  do  basically 
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more  oversight  because  our  oversight  over  time  has  become  more 
efficient . 

THE  COURT:  And  how  about  --  and  maybe  you've  in  one 
sense  maybe  answered  this  in  part,  but  what's  the  result  of  the 
reviews  been?  What  are  the  problems  you're  seeing  at  this 
point? 

^  would  say  the  most  common  problem  --  and 
"common"  is  a  relative  term  here,  because  the  volume  of 
selectors  is  huge,  and  the  number  of  problems  that  we're 
actually  seeing  is  relatively  small.  As  I've  said,  as  we've 
engaged  in  oversight  and  engaged  NSA  in  discussions  on  how  they 
can  improve  the  sheets  and  tasking  determinations  and  things  of 
that  nature,  the  number  of  problems  that  we've  seen  have 
diminished  over  time. 

I  would  say  the  most  common  problem  is  to  the  extent  that  a 
tasking  determination  is  based  on  a  wide  range  of  information, 
there  m.ay  be  a  problem  with  how  the  source  of  that  information 
is  cited,  whether  it  be  somebody  just  inadvertently  mistyped 

or  a 

a  key  piece  of  infonriatidn  that  was  part  of  the 
broader  range  of  circumstances  upon  which  NSA  made  its 
foreignness  determination. 

So  it’s  more  the  little  technical  things  that  we’ve  been 
seeing  problems  with  on  a  very  small  scale,  and  as  I’ve  said, 
it’s  diminished  over  time. 
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THE  COURT:  I  think  before  Judge  Kotelly  you 


identified  about 


cases  where  it  appeared  that  a  targeted 


person  was  in  the  U.S.,  and  again,  I  don't  even  think  I  know 
what  time  frame  that  was  for,  but  in  any  event,  can  you  do 
anything  like  that  now?  I  mean,  since  that  hearing  in  December 


of  '07. 


Since  that  time,  that  number  captured  a 


number  of  different  types  of  incidents  that  were  reported  to  us. 
There  are  incidents  where  there’s  true  noncompliance  vjith  the 
targeting  procedures  that  results  in  basically  an  improper 
tasking,  whether  it  be  because  the  person  was  actually  located 
in  the  United  States  or  the  person  was  a  U.S.  person  and  we  did 
not  have  2.5  authority  to  target  that  person. 

That  number  also  captured  instances  where  NSA  had  a 
reasonable  belief  that  the  person  was  located  outside  the 
United  States  at  the  time  of  targeting  but  since  that  time  has 
roamed  into  the  United  States,  what  we  call  a  "roaming  incident." 

A  third  type  of  incident  that  that  number  captured  is  what 
we  would  call  a  tasking  error  where  NSA  would  run  a  particular 
facility  through  its  targeting  procedures  but  in  the  act  of 
actually  targeting  that,  by  keying  in  the  account  or  phone 
number  into  the  tasking  tool ,  there  was  a  typo  or  something  of 
that  nature. 

At  the  time  of  the  hearing,  we  hadn~'t  fully  determined 
which  incidents  fell  necessarily  into  which  category.  Since 
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that  time,  we've  had  an  opportunity  to  do  that.  And  for 
incidents  that  were  reported  to  us  through  May  9  of  this  year, 
^■incidents  involved  instances  where  a  target  was  targeted 
improperly  under  the  targeting  procedures . 

We  had  incidents  --  one  of  the  things  that  NSA  is 
rec[uired  to  do  when  they  identify  somebody  who  has  roamed  into 
the  States  is  to  notify  us  of  that  within  72  hours  of  making 
that  determination. 

We  had  ^  instances  where  a  person  had  roamed  into  the 
States  but  the  NSA  did  not  meet  that  72-hour  reporting 
requirement.  But  in  all  of  those  |||||  cases.,  the  tasking  itself 
was  reasonable;  it's  just  that  they  failed  to  comply  with  the 
reporting  requirement. 

We're  tracking  a  nxiitiber  of  other  incidents,  but  with 
respect  to  those  incidents,  we're  pretty  much  in  the  same 
posture  that  we  were  back  in  December:  They've  been  reported  to 
us;  we  don't  have  all  the  facts  with  respect  to  those  incidents 
yet  in  order  to  be  able  to  categorize  them  and  say,  okay,  this 
is  a  true  noncompliance  incident,  this  is  just  a  roaming 
incident,  or  this  is  just  a  tasking  error. 

THE  COURT:  Now,  the  ^Jsituations  where  you  hadn't 
been  notified  within  72  hours,  you  picked  it  up  in  a  review  much 
later,  or  how  did  it  come  —  did  they  report  it  in  72  hours  plus 
.  1^ . t  or  was  it  picked  up  when  you  went  over  and  —  _ _ _ 


No.,  They .. actual ly_ reported  thos_e  to.  us... 
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THE  COURT:  Okay. 

It  was  just  for  a  variety  of  reasons  they 
could  not  comply  with  the  72  hours.  Sometimes  it's  just  because 
a  final  determination  can  take  a  little  while  simply  to  the 
extent  that  the  information  is  somewhat  ambiguous.  I  think  NSA 
errs  on  the  side  of  caution  and  probably  sets  the  date  of  that 
determination  sooner  rather  than  later  such  that  the  72-hour 
reporting  requirement  is  triggered  basically  at  the  first 
instance  or  first  indication  as  opposed  to  when  a  final 
determination  is  made. 

Again,  we’ve  sort  of  refined  the  reporting  requirement  and 
.  have  explained  to  NSA  basically  when  that  72 -hour  reporting 
requirement  kicks  in  such  that  we've,  again,  seen  less  and  less 
of  these  incidents  as  time  has'  gone  on. 

THE  COURT:  So  you've  taken  steps  to  make  sure  that 
NSA,  their  people  understand  at  least  your  view  of  the  72  hours 
in  order  to  cut  down  on  the  situations  where  things  aren't 


.  reported. 


Yes.  That's  one  of  the  most,  I  think, 


valuable  aspects  of  the  oversight  visits.  It's  not  just  to,  you 
know,  we  sit  there  and  we  review  and  go  over  things  with  NSA, 
but  then  we  sort  of  have  --  at  the  end,  we  sort  of  have  a 
roundup  where  we  all  talk  about  issues  that  have  been  identified 
and  ways  that  we  can  either  fix  problems  or  correct  things.  And 
I  think  we’ve  won  the  fruits  of  that,  as  I  said,  because  the 
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number  of  incidents  we've  seen  has  been  diminishing  over  time. 

THE  COURT:  Okay.  Now,  what  do  you  foresee  under  the 
FISA  Amendments  Act?  Do  you  foresee  the  same  procedures  for 
your  oversight  being  implemented?  Are  you  planning  on  different 
procedures?  What  are  your  thoughts? 

I  can't  say  for  certain.  I  would 
anticipate  that  things  would  not  change,  simply  because  in  my 
view  they’ve  been  working  very  well.  As  I've  said,  we've  seen 
improvement,  I  think,  just  the  whole  process  as  we've  refined  it 
over  the  last  year.  I  think  where  we  are  right  now  is  probably 
—  we're  in  a  good  spot  with  respect  to  oversight,  in  my  view. 

THE  COURT:  All  right.  Well,  what  about  the  non-U. S. 
person  status,  which  of  course  is  new  under  the  FISA  Amendments 
Act?  Are  you  going  to  be  changing  anything  in  terms  of  focusing 
on  that? 

already  sort  of  do  with  respect  to  — 
the  U.S.  person  status  is  so  intertwined  with  the  location  of 
the  target  to 

extent  that  in  the  past  NSA  would  actually  affirmatively 
identify  targeted  U.S.  persons  to  us  on  the  sheets,  because  one 
of  the  additional  fields  that  they  put  in  the  sheets  is 
basically  a  blurb,  an  explanation  and  a  description  of  the 
target . 

- Clearly,  we're  not  allowed  to  target  U.S.  persons  anymore. 


so  I  don't  anticipate  seeing  any  such  descriptions  on  the 
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sheets.  But  again,  since  the  status  of  the  person,  the 
determination  of  how  that  is  made  is  so  intertwined  with  the 
same  information  upon  which  NSA  relies  to  make  a  foreignness 
determination,  that  it  would  be  hard  for  us  not  to  identify  such 
information  as  we're  conducting  the  reviews. 

THE  COURT:  Has  there  been  --  and  maybe  you've  said 
this,  but  is  there  thought  to  be  or  are  you  planning  to  or  have 
you  already  sat  down  with  people  or  issued  things  so  that  they 
can  now  focus  on  the  fact  that  we've  got  the  non-U. S.  person 
status,  which  is  also  something  they  need  to  be  focusing  on? 

I  don't  think  we've  had  formal .  discussions 
about  it.  Again,  this  wasn't  an  issue  that  has  cropped  up  out 
of  nowhere  where  we  sort  of  had  to  still  deal  with  this  issue  in 
the  context  of  the  Protect  America  Act,  because  under  the 
certifications,  we  were  not  allowed  to  target  U.S.  persons 
unless  we  had  2.5  authority. 

THE  COURT ;  Okay . 

So  we  always  had  this  affirmative  -- 
although  it  was  not  affirmatively  stated  in  the  targeting 
procedures,  there  was  an  implicit  requirement  to  ensure  that 
we're  not  inadvertently  or  intentionally  targeting  U.S.  persons 
in  the  absence  of  such  authority. 

So  the  types  of  checks  that  we're  doing  now  build  upon 
checks  that  we  were  doing  previously  in  order  to  satisfy  that 
requirement  or  limitation. 
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THE  COURT: 


did.  you  want  to 


follow  up  on  that  at  all?  I  know  you  guys  were  here  last  time. 
Anything? 


I  don ' t  think  I  have  anything . 


THE  COURT :  Okay .  Thank  you  on  that . 


My  next  issue  has  to  do  with  departures  from  procedures,  if 
I  can  phrase  it  that  way.  Let  me  find  out  where  we're  going. 

Here  we  are.  I  know  that  --  at  least  I  believe  the  staff 
talked  with  you  about  this  before  this  hearing,  and  it's  page  10 
of  the  targeting  procedures.  Let  me  just  get  them  out. 

"If,  in  order  to  protect  against  immediate  threat  to  the 
national  security,  the  NSA  determines  that  it  must  take  action, 
on  a  temporary  basis,  in  apparent  departure  from  these 
procedures,"  and  I  know  that  --  again,  was  it  at  the  hearing 
perhaps?  I’m  not  remembering  whether  it  was  at  the  hearing  or 
not.  In  any  event,  I  know  in  the  past  there  has  been  a 
representation  of  the  situations  that  you  contemplate  coming 
within  this.  I  don't  think  you  dealc  with  that  in  your  response 
from  yesterday. 


No,  we  didn' t . 


THE  COURT:  Okay.  Could  you  just  confirm  for  us  —  I 


know  you've  already  had  discussions  with  staff,  but  tell  me  what 
you  expect  to  be  contemplated  by  this  provision. 

First,-  I  think  the  circumstances  _under 
which  this  provision  would  be  triggered  would  be  very  extreme 
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circumstances:  an  imminent  terrorist  attack  or  a  terrorist 
attack  that  has  occurred  or  something  of  equal  significance. 

With  respect  to  the  types  of  departures,  I  mean,  in  all  cases  we 
will  continue  to  adliere  to  the  li.mitations  set  forth  in  the 
statute . 

We  are  anticipating  that  the  types  of  departures  would  be 
on  a  more  technical  level  such  as  perhaps  because  NSA  personnel 
are  devoted  to  addressing  or  countering  this  terrorist  threat, 
they  may  not  be  able  to  devote  the  resources  necessarily  for  us 
to  conduct  an  oversight  reviev;  within  the  allotted  60  days. 

THE  COURT:  Has  this  been  used?  Has  the  PAA  provision 
ever  been  used? 


We've  never  invoked  it. 

THE  COURT;  Never  invoked.  Okay.  Can  you  give  me  a 
little  more  meat  on  the  bones  on  what  you  would  contemplate? 


I  think  the  other  situation  we  thought 
of  is  an  emergency,  as  describes,  and  our  actual 

system  for  recording  things  is  down.  So  technically  we  can't 
get  to  the  system  where  we'd  record  this.  We'd  still  make  a 
note  of  what  we've  done,  so  we  would  comply  substantially  with 
what's  required,  we  wouldn't  want  the  issue  to  arise  and  prevent 
us  from  doing  what  we  need  to  do,  are  we  complying  in  every 
“detail":  - 


So  that's  the  kind  of  thing  that  I  think  we  contemplate 
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that  it  could  be  used  in,  and  again,  my  own  e>53ectation  is  it 
will  never  be  used,  but  we  did  provide  for  it  in  the  unlikely 
event . 

THE  COURT;  Okay.  All  right.  Let's  talk  for  a  little 
bit  about  these  about  communications. 

What  I  would  find  very  helpful  --  can  someone  just  briefly 
and  with  not  a  lot  of  technical  but  some  technical  aspects  talk 
to  me  about  how  communications  are  acquired?  Are  they  acquired 
in  a  different  way  than  the  to-ox-from  communications?  I  mean, 
as  I  understand  it,  you're  not  acquiring  them  from  Internet 
service  providers,  like 

Judge,  if  I  may,  I'm  going  to  let 
j^^^^^mcome  to  the  table  because  he's  one  of  the  people  who 
can  explain  this. 

THE  COURT:  Oh,  wonderful.  Come  on  up,  sir.  This  is 


(b)(1):  (b)(3);  (b)(7)(E) 


Yes,  typically  for  about 
communications,  right  now  we  do  not  acquire  them  from  Internet 
service  providers 


So  what  happens  there  is  you  pick  up  things  like  two 
unknown  communicants  to  us  and  the  to-from  talking  about  one  of 


TOP  SBC'RET-/-/COMIMT/ /0RC=£ai.,  iqiitOrHDffiU-8936  (RMB)  000392 


'-8936  (RMB)  000393 


Case  l;15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1093  of  1298 

All  withheld  information  exempt  under  (b)(1jjnd/o^(gp^'gj^s^  ^  ■,^^^,p^gj^yved  for  Public  Release  ^  ^ 


THE  COURT; 


(b)(1):  (b)(3):  (b)(7)(E) 


(b)(1);  (b)(3);  (b)(7)(E) 


you  do  it? 


How  do 


(b)(1):  (b)(3);  (b)(7)(E) 


THE  COURT :  Yeah . 

—  that  then  ensures 


(b)(1):  (b)(3):  (b)(7)(E) 


(b)(1);  (b)(3):  (b)(7)(E) 


THE  COURT:  Okay.  Can,  we  talk  for  a  minute  -- 
obviouslyi,_the  issue  for.  the  Court  and  f pr^  the  government,  as 
you  came  up  with  all  these  procedures,  is  the  reasonableness 
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Standard,  and  the  Court  is  looking  at  that  as  well  as, 
obviously,  compliance  with  the  Fourth  Amendment,  which  in  itself 
is  a  reasonableness  standard,  I  guess,  as  well. 

Do  the  ahouts  present  a  different  issue  in  terms  of  the 
reasonableness,  do  you  think?  Let  me  just  e3<pand  a  little  bit 
on  that  and  have  some  response  to  it. 

What  percentage  of  the  acquisitions  are  abouts,  as  opposed 
to  to  and  from?  Is  an  about  acquisition  more  or  less  likely  to 
pick  up  communications  that  otherwise  you  wouldn't  be  allowed  to 
pick  up  for  whatever  reason?  Do  they  present  harder  issues  for 
reasohableness? 

Somebody  want  to  start  discussing  that  with  me?  Have  you 
thought  about  that? 

As  far  as  the  percentage  number,  we  don't 
have  a  number  for  that,  because  as  I  mentioned  earlier,  when  we 

we  to's  and  froms  and 

so  we  don't  categorize  those  separately  to 
be  able  to  count  those  communication  as  abouts. 

So  we  don't  have  any  numbers.  I  can  tell  you  as  far  as 
usefulness,  they're  very  useful,  and  we  see  them  routinely,  but 
I  don '  t  have  a  nirmber  for  you  on  that . 

THE  COURT:  And  in  terms  of  the  usefulness,  their 
importance  to  what  you're  trying  to  accomplish,  talk  to  me  a 

_ ^liitle._bit„  about  that.  As  important  as  a  to  or  from,  less _ 

-important?-  What  role -do -they  play  in  wha.t  you’ re_  doing? . . 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1095  of  1298 

All  withheld  information  exempt  under  (b)(1)  and/or  (b)(3)  unless  otherwise  noted.  Approved  for  Public  Release 

TOP  SEC-R-ET//GOMINT//ORCOMy  NOFOPJN  23 


(b)(1):  (b)(3);  (b)(7)(E) 


¥©P  S ECRE-T  /  / COMINT  /  / QR.GQN-r 


(I6-CV-8936  (RMB)  000396 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1096  of  1298 

All  withheld  information  exempt  under  (b)m^d/or(bV^ unless  pttemjM  noted.,  „,.,„^pved  for  Public  Release 


-8936  (RMB)  000397 


Case  l;15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1097  of  1298 

All  withheld  information  exempt  under  (b)(1)_and/oj[  {b)|^  unless  ohierwise  nmed. _  _  _  _AEproved  for  Public  Release 


g-ECRET-/  /CQIvTINT/  /ORCjm.-^MOFQia^ 


25 


But  even  to  the  extent  that  one  of  the  communicants  was  a 
U.S.  person  or  was  located  in  the  United  States,  to  the  extent 
that  there's  U.S. -person  information  in  the  ahouts  communication, 
that  information  will  be  subject  to  the  minimization  procedures. 

THE  COURT:  Okay.  Anything  from  staff  on  the  abouts? 
I'm  going  to  talk  some  more  about  the  filter  issue  but  from  a 
different  perspective.  Anybody? 

Judge,  I  think  I  do  have  a  gnestion. 

THE  COURT:  Yes.  Go  ahead,  Phil. 

When  you  how 

these  about  communications,  you  described  it  in  a  way 
--  well,  you  said  that  P^^^^|P^^P^|^^^^^^^^acquiring  the 
to-or-from  communications 


you  to  for  whatever 

reason,  would  it  be  technically  feasible  to  --  in  the  same 
manner 

would  be  technically 

to  acquire  only  communications  that  are  to  or  from  the  selector 
account  and  not  those  communications  that  otherwise  contain  a 
reference  or  name  of  a  selector  account? 

It  is  technically  feasible.  The  problem 
with  doing  so  is  if  you  end  up  discarding  a  number  of 
communications  that  are  truly  to-troms  that  you  should  be  able 
to  collect  but 
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we  assess  it  as  to  whether  we  want  to  make  a  new  target  there  of 
the  person  overseas.  But  it's  important,  I  think,  to  understand 
there's  no  follow-on  automated,  now  we  found  a  new  person,  a  new 
person,  a  new  person,  and  those  are  not  automatically  added  to 
our  task  mode . 

So  it's  a  limited  look  with  our  target,  the  user  of  the 


THE  COURT:  Yes.  I'm  glad  you  brought  that  up, 

because  what  I  understand,  and  I  think  you've  just 


said  it,  is  that  when  you're  picking  up  the  about,  you're  also 
getting  information  on  the  to  and  from.  But  if  the  to  or  from 
is  now  a  person  of  interest,  but  if  it's  a  U.S.  person,  for 
example,  or  something,  you  couldn't  continue  to  just  pick  up 
that  person,  directed  at  the  person,  but  then  you'd  have  to  come 
into  court  with  an  application  or  do  whatever  else.  But  you're 
not  automatically  then  following  that  person. 

That's  correct. 

THE  COURT:  Now,  on  the  IP  --  this  is  getting  to 
minimization,  but  because  it  relates  to  the  filters,  let's  talk 
about  it.  And  this  is  on  page  5  of  your  written  response  from 
yesterday.^  The  NSA  minimization  procedures,  you're  stating, 
"contain  a  provision  for  allowing  retention  of  information 
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because  of  limitations  on  NSA's  ability  to  filter 
communications."  My  question  I  had  vjas  is  the  filter  discussed 
in  targeting  the  same  filtering.  I  just  wanted  to  understand 
that,  and  apparently  it  is. 

But  talk  to  me  a  little  bit,  because  there  seemed  to  be 
some  tension  there. 


(b)(6):  (b)(7)(C) 


_  I  think  the  inclusion  of  that  provision  in 

the  minimization  procedures  was  intended  to  be  prophylactic  in 
the  event  that  the  filters  don't  necessarily  work,  and  NSA  has 
represented  that  it's  been  their  experience  with  the  filters  and 

tha  t  have 

captured  purely  domestic  communications  with  respect  to  the 
about s. 

But  to  the  extent  that 


this  provision  basically  captures  instances  where  the  filters 
may  not  work  in  every  instance. 

THE  COURT:  You  did  respond  to  this,  but  I  guess  maybe 
just  a  little  bit  more  on  how  limited  are  they.  I  mean,  what 
are  the  limitation  of  these  filters?" 
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THE  COURT:  Okay.  Again,  going  on  or  continuing  with 
minimization  procedures,  let  me  see  where  I  am  here.  Just  a 
couple  of  things  that  I  think  the  staff  confirmed  with  you  prior 
to  the  hearing  when  they  raised  various  issues.  And  it  wasn't 
in  your  memo  from  yesterday,  so  I'll  just  raise  it  here.  But  as 
I  unders  tand  i t , 


(b)(1);  (b)(3);  (b)(7)(E) 


lb)(6);  (b)(7)(C) 


That's  correct. 

THE  COURT:  Okay.  And  on  page  1,  I  guess  it  was,  of 


Yes . 

THE  COURT:  All  right.  And  then  I  wanted  to  go  to 
3(b) (1)  of  the  minimization  procedures,  a  paragraph  I  will  tell 
you  that  I  had  some  struggles  with,  but  now  I  think  I  understand 
it . 

This  will  be  the  NSA  minimizations  -- 
THE  COURT:  I'm  sorry,  NSA. 

All  right.  Now,  first  of  all,  as  I  understand  it,  I 
thought  there  was  a  "not"  missihgj  and  there  was." 

There  is . 


b)(6):  (b)(7)(C) 
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THE  COURT:  Okay,  that’s  fine.  I  kept  reading  and 
thinking  I  was  missing  something,  and  it  took  me  awhile.  But 
let  me  just  say  to  you  what  I  understand  this  paragraph  to  mean, 
and  then  tell  me  if  it  --  that  "NSA  shall  destroy  inadvertently 
acquired  U.S. -persons  communications  once  they  are  identified  as 
both  clearly  not  relevant  to  the  authorized  purpose  of  the 
acquisition  and  not  containing  evidence  of  a  crime."  And  also 
"inadvertently  acquired  U.S. -person  communications  includes 
these  electronic  communications  acquired  because  of  limitations 
of  the  ability  to  filter."  That  was  the  filter  issue. 

That's  what  will  happen,  and  the  time  limit  is  a  maximum  of 
five  years. 


THE  COURT:  It  will  be  done  at  least  with  respect  to 
the  first  part  of  3(b)(1)  at  the  earliest  practical  point,  but 
at  least  five  years  -- 


b)(6):  (bX7KC) 


No  later  than  five  years. 

THE  COURT:  No  later  than  five  years.  And  I 
understand  that  five  years  has  been  a  time  frame  that  has 
appeared  in  other  procedures,  but  I  think  it  probably  would  be 
helpful  to  just  sort  of  talk  a  bit  about  where  that  comes  from, 
why  is  that  a  number  that's  been  selected. 

NSA  can  correct  me  if  I'm  wrong;  the  five 
years  comes  from  the  fact  that 
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That,  I  think,  is  the  general  thinking  behind  the  five-year 
retention  period.  That's  the  potential  analytical  life  cycle  of 
a  particular  piece  of  information. 

Your  is 

for  the  NSA, 

THE  COURT:  Sui"e ,  Yes,  sir. 

In  a  couple  of  other  places  in  our 
minimization  procedures,  namely  in  Section  5  and  Section  6,  we 
talk  about  the  five-year  rule  where  in  certain  cases  the 
intelligence  director  may  extend  that  in  the  case  of  domestic 
communications  or  in  the  case  of  U.S. -person  information  if 
again  it  has  foreign  intelligence  value  or  evidence  of  a  crime. 

So  in  3(b) (1)  we  talk  about  five  years,  but  there  are  a 
couple  of  other  sections  that  might  be  invoked  by  our  SID 
director  where  he  could  extend  it. 

THE  COURT:  Yes.  Well,  I  think  this  makes  clear  that 
it's  not  talking  about  things  that  are  not  relevant  --  it's  only 
talking  about  things  that  are  not  relevant  to  the  authorized 


TOP  SECRS-'lV-/'€QMIMT7/ORGQW-,  MQyftRW8936 (RMB)  000407 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1107  of  1298 

Ali  withheld  information  exempt  under  (b)a)-^/Qi;fbK;amteS6pte8tw^aot9d^p'-rsr.p|->T  T.Tr'iv.^Bflroved  for  Public  Release 


35 


purpose  of  the  acquisition  and.  not  containing  evidence  of  a 
crime.  So  the  implication  is  that  if  it  does  do  that,  the  five 
years  may  not  necessarily  be  --  fair  enough. 

All  right.  Number  13,  page  11  of  your  response  from 
yesterday.  Now,  I  had  a  couple  of  questions  with  respect  to  the 
three  minimization  procedures  and  what  they  say  about  the 


director  being  able  to  do  certain  things,  but 


[(b)  (b)(6MbK7)(C) 


understand  that  you  alerted  the  staff  before  the,  hearing  that 
there's  another  potential  issue  that  you  have  thought  of  that 


could  impact  this  issue. 


(b)(6);  (b)(7)(C) 


Correct.  There’s  a  provision  in  the  FISA 


that  was  recently  changed,  1806  (i),  which  basically  says  --  the 
previous  iteration  of  that  provision  of  the  statute  said  if  you 
are  unintentionally  acquiring  radio  communications  when  the 
sender  and  all  intended  recipients  are  located  in  the 
United  States,  the  attorney  general  has  to  determine  whether  or 
not  that  piece  of  information  can  be  retained  in  very  extreme 
circumstances,  otherwise  such  circumstances  have  to  be  destroyed 
upon  recognition. 

The  recent  FISA  Amendments  Act  struck  "radio"  out  of  that 
provision  such  that  the  provision  appears  to  on  its  face  apply 
to  all  types  of  acquisitions  conducted  under  the  act.  Whether 
or  not  that  particular  provision  applies  to  this  type  of 
collection  such  that  it  would  require  us  to  basically  destroy 
domestic  ..cpitmunicatipns_.as  they  .are  recognized  is  an  .is_sue  _that 
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we're  still  trying  to  work  through. 


THE  COURT:  Okay.  All  right.  And  I'm  sure  we'll 


continue  to  talk  on  that  as  you  work  it  through,  and  thank  you 
for  alerting  us  to  that.  Let  me  go  forward,  though,  with  the 
minimization  procedures  as  they  are,  and  let  me  ask  a  couple  of 
questions  about  them,  putting  aside  for  the  moment  this  issue 
with  1806. 

We  had  one  question  for  you,  and  now  I  don't  know  if  we 
asked  you  this  before,  but  the  one  C[uestion  was  the  NSA  and  the 
CIA  procedures  had  the  directors  doing  things  in  writing.  And 
the  FBI  provision  didn't  say  "in  writing,"  but  as  I  understand 
it,  the  FBI,  as  you  cite  here,  has  represented  that  any  such 
determination  by  the  director  would  be  made  in  writing  even  if 
not  expressly  required. 


Correct . 


THE  COURT:  Okay.  That  answers  that.  Another  similar 


kind  of  question.  There  may  be  no  significance  to  the 
difference  in  language,  but  the  NSA  procedures  at  page  5  say, 
and  I'm  paraphrasing  because  I  don't  have  the  exact  quote,  that 
unless  the  director  "specifically  determines"  something. 

And  then  the  FBI  provisions  simply  say  "unless  the  director 
determines, "  and  I  think  the  CIA  also  says  "unless  the  director 
determines."  Is  there  any  meaning  I'm  supposed  to  take  from 
"specifically?" 


No.  I  think  "specifically"  was  just 
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intended  to  capture  the  notion  that  this  would  be  on  a 
case-by-case  basis  as  opposed  to  just  a  broad-base,  I'm  going  to 
exempt  this  particular  gigantic  class  of  communications . 

THE  COURT:  But  I  take  it  the  FBI  and  a  CIA  would  also 
be  on  a  case -by- case  basis. 

Yes 

THE  COURT:  Yeah,  I  didn't  think  it  had  a  lot  of 
significance,  but  you  never  know,  so  I  thought  I'd  ask. 

You  know,  I  may  be  at  the  end  of  my  list.  What  I'd  like  to 
do  is  take  a  break.  But  since  there's  fewer  of  us  than  of  you, 
we  will  step  out,  and  then  you  can  stay  here  and  if  --  because 
there's  a  lot  of  people  here. 

Obviously,  use  the  time.  If  something  was  said  here  that 
you  have  an  issue  with  because,  you  know,  at  least  from  your 
experience  it  doesn't  work  that  way,  please  talk  among 
yourselves  and  we  can  straighten  that  out.  Or,  if  I  had  asked  a 
question  and  you  say.  Gee,  I  think  the  best  answer  is  X  and 
nobody  said  X,  please  feel  free  to  tell  and  we  can 

get  that  better  answered  on  the  record. 

Okay.  Thanks,  everybody.  Just  give  us  a  few  minutes . 

(Recess  taken. ) 

THE  COURT:  Just  a  couple  things.  Going  back  to  the 
abouts,  if  we  can  go  back  to  them  for  a  moment,  you  know  the 
Court  will  have  to  do,  obviously,  a  Fourth  Amendment  analysis  in 
terms  of  the  reasonableness  —  of  all  the  procedures,  not  just 
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of  the  abouts. 

But  I  guess  my  question  is,  is  there  a  different  analysis 
for  the  abouts  than  for  the  to  or  from?  Or  to  put  it  another 
way,  could  somebody  articulate  for  me  what  you  believe  why  the 
abouts  don't  present  a  different  Fourth  Amendment  issue  from  the 
to's  and  the  froms,  that  it's  the  same  issue? 

Again,  to  amplify  even  a  little  more,  is  the  possibility  of 
acquiring  information  that  otherwise  it  would  not  be  permissible 
to  acquire  in  the  about  scenario  different  from  the  to  or  from? 

In  other  words,  is  it  incidental?  Would  you  describe  it  in 
chat  way?  If  not,  how  would  you  describe  it?  Is  it  any  less  or 
more  likely  to  happen  with  the  abouts  than  with  the  to  or  from? 
Or  any  other  aspect  of  the  Fourth  Amendment  analysis  that  you 
think  is  relevant. 


I  don't  think  that  the  Fourth  Amendment 
analysis  is  any  different  with  respect  to  an  abouts 
communication  or  to  or  from.  I  mean,  it's  just  as  likely  that 
one  end  of  a  to  or  from  could  be  a  U.S.  person  in  communication 
with  a  target  as  an  about. 

In  either  case,  the  U.S. -person  information  contained  in 
that  communication  would  be  sxobject  to  the  minimization 
procedures,  and  it's  not  that  U.S.  person  that  is  the  target  of 
che  acqiuisition  of  that  particular  communication;  it  is  the  user 
of  the  targeted  selector  that  appears  in  the  body  of  that 


communication.  So  I  think  for  Fourth  Amendment  purposes,  with 
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respect  to  U.S.  persons,  I  don't  think  the  analysis  is  any 
different . 

MR.  OLSEN:  We  have  given  some  thought  to  this, 
because  shouts  collections  has  been  an  issue  in  this  collection 
as  well  as  prior  court  orders.  But  I  just  would  reiterate  what 
said  in  terms  of  our  view  of  it  in  that  it's 
essentially  for  the  Fourth  Air.endment  purposes  an  incidental 
collection  where  the  target  is  the  targeted  account,  and  to  the 
extent  that  a  U.S.  person's  communication  --  to  or  from  a  U.S. 
person,  that  would  be  deemed  to  be  incidental  to  the  collection. 

And  therefore  under  the  analysis  we  put  forward  in,  for 
example,  the  Yahoo  litigation,  that  would  be  permissible  and 
reasonable  under  the  Fourth  Amendment  as  long  as  minimization 
procedures  are  appropriately  applied. 

THE  COURT:  Is  it  more  or  less  likely  to  pick  up 
U.S. -person  information  in  an  about  than  a  to  or  a  from? 

MR.  OLSEN:  I  don't  know  the  answer  in  practice.  At 
least  from  my  perspective  in  theory,  I  wouldn't  see  why  it  would 
be  more  likely  than  a  targeted  to  or  from  collection  where  the 
target's  outside  the  United  States  where  there's  similarly  the 
possibility  that  that  target  would  be  in  communication  with 
someone  in  the  United  States,  with  a  U.S.  person  in  the 
United  States. 

So,  just  analytically,  I  think  the  same  incidental 
collection  subject  to  minimization  procedures  framework  would 
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apply.  And  so  under  the  Fourth  Amendment  applying,  that  we 
would  submit  would  be  reasonable  under  the  Fourth  Amendment. 

And  I  would  note  that  in  his  opinion  on 
the  Yahoo  litigation,  Judge  Walton  recognized  the  reasonableness 
of  a  presumption  that  non-U, S.  persons  located  overseas  are  more 
likely  to  communicate  with  other  non-U. S.  persons  located 
overseas  which  may  bear  on  the  volume  of  potentially  —  or 
a.bouts  communications  that  potentially  implicate  U.S.  persons 
versus  non-U. S.  persons,  I  think  if  you  apply  that  presumption, 
it's  more  likely  that  an  about  will  not  implicate  U.S. -person 
information , 

THE  COURT;  Okay.  Fair  enough. 

Well,  that's  really  all  that  I  — 

Judge,  I'm  sorry. 

THE  COURT:  Yes  .  Go  ahead, 


With  regard  to  the  abouts,  it's  occurred 


to  me,  just  to  be  clear  on  the  record,  there  were 


ort  of 


subcategories  of  such  communications  that  were  laid  out  in  a 
footnote  to  Judge  Kotelly's  opinion  in  the  PAA  that  in  turn-  I 
think  referred  to  an  opinion  issued  or  an  order  issued  by^  Judge 


Vinson  last  year. 


Do  those 


categories,  as  previously  set  out  in  those 


places,  continue  to  be  accurate  and  up  to  date  and  complete  in 

-terms— O-f— the- -C ommuni-ca.t i ,ons._thaJt_ .are.  obtained? _ 

-I-  think-so.-  If  I  recall,  correctly,  and. -I 
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following  the  hearing.  This  has  been,  as  I  think 


[(b)(6):  (b)(7)(C) 


mentioned,  been  an  issue  we  identified  yesterday  or  the  day 
before  in  the  evening. 

So  we  have  the  right  folks  here  to  talk  about  it,  and  my 
expectation  first  would  be  that  we  would  be  able  to  communicate 
directly  with  the  Court  staff.  I  don't  know  how  quickly  we  will 
have  a  definitive  answer,  but  I  would  expect  that  we  will  have  a 
definitive  answer,  understanding  the  timing  of  this  overall,  by 
tomorrow  at  some  point  and  that  what  I  expect  to  do  is  to  have 
something  in  writing,  perhaps  not  very  formal,  something  along 
the  lines  of  what  we  recently  gave  to  the  Court  to  address  this 
issue. 

It  may  be  that  that  will  be,  in  terms  of  our  view,  that  we 
think  we  have  a  resolution  to  the  issue  and  that  no  further 
action  is  necessary.  It  may  be  that  we  have  other  steps  to 
propose  to  the  Court,  but  we  certainly,  understand  the  inportance 
of  moving  quickly  and  turn  to  this  right  away. 

THE  COURT:  Okay.  Fair  enough. 


(b)(6):  (b)(7)(C) 


And  there  were  three  other  issues  that 


we'd  just  like  to  clarify,  statements  that  were  made  previously 
that  we  just  want  to  provide  maybe  a  fuller  context  to. 

THE  COURT:  Sure. 


(b)(6);  (b)(7)(C) 


With  respect  to  oversight  and  the  number 


of  compliance  incidents  that- we've  identified,  just  to  give  you 
some  perspectiye._pn..the  relative  ..nature  of  that,  number,  .since 
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(b)(6);  (b)(7)(C) 


THE  COURT:  Yeah.  If  they're  discovered. 

They  would  be  destroyed  at  that  time. 
THE  COURT:  Obviously,  if  they're  not  --  okay. 

now  that  I've  read  them  again,  can  you  just 
repeat  what  you  said  you  wanted  to  make  clear,  that  this  wasn't 
on  a  case-by-case  basis? 

It  can  apply  to  a  broader  range  of 
communications.  It's  not,  okay,  the  SID  director  determines 
that  this  -- 


THE  COURT:  Particular  little  thing  right  there. 

—  meets  this  standard,  therefore  I  can 
extend  the  retention  duration  beyond  che  five  years.  It  can  be 
a  range' of  communications. 

'  •  I  • 

THE  COURT:  Just  give  me  an  example.  I  think  we  just 
had  one.  Can  somebody  give  me  an  example? 


(b)(6):  (b)(7)(C) 
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Abstract — Stream  Reassembly  is  an  indispensable  function  of 
Deep  Packet  Inspection,  wbicb  is  an  critical  element  of  Network 
Intrusion  System.  However,  since  it  need  to  heavily  move  packet 
payload  from  one  block  of  memory  to  another  block  of  memory. 
Stream  Reassembly  has  a  serious  memory  performance  issue. 
In  this  paper,  in  order  to  improve  the  Stream  Reassembly 
performance,  a  Stream  Reassembly  Card  (SRC)  is  designed, 
which  enables  to  manage  and  assemble  streams  through  adding 
a  level  of  buffer  to  adjust  the  sequence  of  packets  by  using 
the  Multi-core  NPU.  Specifically,  three  optimistic  techniques, 
namely  Stream  Table  Dispatching,  No-Locking  Timeout,  and 
Multi-channel  Virtual  Queue  are  introduced  in  SRC  design.  The 
experiments  show  that  the  reassembly  can  achieve  more  than  3 
Gbps  in  terms  of  processing  speed,  triply  outperforming  over  the 
traditional  server  based  architecture. 

Index  Terms — Network  Security;  Network  Intrusion  System; 
Network  Forensics  System;  Multi-core  NPU;  Stream  Reassembly; 

I.  Introduction 

DPI  (Deep  Packet  Inspection)  is  a  critical  technique  for 
Network  Forensic  System  (NFS),  where  packet  payloads  need 
to  be  matched  against  pre-defined  patterns  to  obtain  the 
evidences  with  a  4-step  process,  namely  preprocessing,  header¬ 
matching,  content-matching  and  outputting  in  NIDS  and  NFS. 
In  general,  in  the  event  of  a  network  with  a  low  speed,  server 
based  approach  (in  which  the  stream  reassembly,  rule  matching 
and  warning  are  all  conducted  by  one  server)  can  satisfy 
the  performance  requirement.  However,  with  the  exponential 
increasing  of  bandwidth,  the  traditional  server  based  approach 
(even  for  a  server  with  high  performance)  no  longer  meets 
the  performance  requirement.  To  break  up  this  bottleneck, 
many  researches  have  been  carried  on  to  improve  the  overall 
performance  by  achieving  efficient  content-matching  [l]-[6]. 

Many  previously  reported  methods  mainly  focus  on  improv¬ 
ing  the  rule  matching  algorithms,  and/or  using  FPGA  [1], 
[2]  or  GPU  [3]-[6]  for  efficient  content-matching,  and  the 
results  show  that  the  ratio  of  running  time  used  for  matching 
is  decreasing  with  the  enhancement  of  matching  performance. 
Experiments  from  some  other  researchers  [7]  further  indicated 
that  when  the  ratio  of  the  matching  time  to  the  overall  decrease 
to  1%,  StreamT  (which  reassembles  streams  in  previous  Snort 
version)  will  take  on  the  load  of  80%  when  it  is  used  to 
assemble  the  packets. 

Currently,  advanced  progresses  have  been  made  in  the 
network  electron  component  area.  For  example,  Raza  Micro¬ 
electronics  has  developed  XLR,  XLS  and  XLP  NPUs,  while 
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Cavium  has  launched  OCTEON  Series  NPU.  The  emergence 
of  these  multi-core  NPUs  can  largely  improve  the  performance 
of  the  network  devices  and  network  security  devices.  In  this 
paper,  we  present  a  new  Stream  Reassembly  Card  (SRC)  de¬ 
sign,  which  enables  to  manage  and  assemble  streams  through 
adding  a  level  of  buffer  to  adjust  the  sequence  of  packets  by 
using  the  Multi-core  NPU. 

II.  Related  Work 

There  are  two  open  source  programs:  Libnids  [8]  and 
Tcpflow  [9]  that  fulfill  TCP  stream  reassembly,  but  both  of 
them  cannot  meet  the  performance  requirements  of  the  current 
network  links.  Researchs  having  relationship  with  stream  are 
often  focus  on  the  measurements. 

For  example,  [10]  has  used  two  data  recorded  from  two 
different  operational  networks,  and  studied  the  flows  in  size, 
duration,  rate  and  burst,  and  examined  how  they  are  correlated. 
[11]  concerned  on  the  problem  of  counting  the  distinct  flows 
on  a  high  speed  network  link.  They  proposed  a  new  timestamp- 
vector  algorithm  that  retains  the  fast  estimation  and  small 
memory  requirement  of  the  bitmap-based  algorithms  while 
reducing  the  possibility  of  underestimating  the  number  of 
active  flows. 

[12]  has  introduced  a  TCP  reassembly  model  and  a  stream 
verification  methodology  that  can  be  used  to  derive  and 
compute  reassembly  errors.  [13]  has  introduced  an  algorithm 
that  solves  the  problem  of  TCP  stream  reassembling  and 
matching  performance  problem  for  network  forensics  system 
and  IDS.  Instead  of  caching  the  total  fragments,  their  methods 
stores  each  fragment  with  a  two-tuple  that  is  constant  size  data 
structure,  thus  the  memory  requirement  involved  in  caching 
fragments  is  largely  reduced. 

[14]  has  introduced  a  hardware  based  reassembly  system 
to  solve  both  the  efficiency  and  robust  performance  problems 
in  the  face  of  the  adversaries  to  subvert  it.  They  characterized 
the  behavior  of  out-of-sequence  packets  seen  in  benign  TCP 
traffic,  and  designed  a  system  that  addresses  the  most  com¬ 
monly  observed  packet-reordering  case  in  which  connections 
have  at  most  a  single  sequence  hole  in  only  one  direction  of 
the  stream. 

III.  Why  Multi-core  NPU  is  Selected 

NIDS  obtains  copies  of  packets  directly  from  the  network 
media,  regardless  of  their  destination.  Raw  packets  captured 
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Fig.  1 .  An  example  of  stream  reassembly. 

by  the  NIDS  are  confused  and  disordered  messes,  but  DPI  in 
NIDS  needs  these  packets  to  be  fabricated  as  integrated  blocks 
according  to  their  TCP  stream  belongings  before  they  are  sent 
to  the  matching  engine. 

Figure.  1  gives  an  instance,  and  the  stream  in  the  example 
is  composed  of  6  packets.  But  packet  2  and  packet  3  are  out  of 
order,  and  packet  4  is  repeated.  The  stream  reassembly  process 
needs  to  exchange  the  sequence  of  packet  2  and  packet  3,  and 
the  unwanted  second  packet  4  should  also  be  deleted.  The 
process  incurs  3  times  packets  movement:  packet  2  moving 
ahead,  packet  3  moving  backwards,  and  packet  5  moving 
ahead.  This  is  just  an  example  of  a  single  stream,  and  in  the 
real  network  environment,  one  backbone  link  may  contain  a 
large  number  of  streams.  In  other  words,  there  may  be  too 
many  packet  movements  in  the  reassembling  process.  Modern 
servers  use  DRAM  (DDR2  or  DDR3)  as  their  main  memory, 
one  memory  access  may  take  a  number  of  cycles  to  obtain  a 
result  because  DRAM  has  a  relatively  long  startup  time. 

However,  multi-core  NPU  can  improve  the  performance  of 
this  kind  of  operation,  which  is  because: 

(1)  There  are  many  hardware  threads  in  one  core  and  many 
cores  in  one  NPU,  which  makes  the  total  threads  in  a  NPU, 
will  be  more  than  a  dozen.  The  threads  of  this  kind  are 
hardware  threads  instead  of  software  threads  so  the  switching 
cost  is  very  low.  The  large  number  of  hardware  contexts 
enables  software  to  more  effectively  leverage  the  inherent 
parallelism  exhibited  by  packet  assembling  applications.  When 
one  thread  is  waiting  for  the  result  of  the  memory  accessing, 
the  other  thread  could  switch  in  and  makes  another  memory 
accessing  request,  and  if  many  threads  use  such  a  pipeline, 
the  latency  of  the  DRAM  will  be  hidden  and  the  effective 
bandwidths  of  the  DRAM  access  would  increase. 

(2)  A  multi-core  NPU  is  often  with  low  electric  power 
consumption,  so  it  is  easy  to  be  manufactured  as  a  card.  When 
a  NPU  based  card  is  used,  an  extra  buffer  is  introduced  to 
the  processing  flow,  so  the  packets  can  be  sorted  as  they  are 
being  transferred  from  the  memory  of  the  card  to  the  memory 
of  the  host  (server),  which  is  a  form  of  trading  space  for 
performance.  In  this  way,  when  the  packets  have  been  received 
into  the  memory  of  the  card,  they  are  stored  in  the  memory 
as  their  reaching  order,  but  their  sequence  are  maintained  by 
the  software  running  on  the  NPU. 

(3)  The  architecture  of  NPU  often  has  a  favorable  I/O 
features,  and  the  packets  could  be  imported  from  the  interface 
to  the  memory  with  high  throughput.  As  the  dispatching 
component  generally  dispatch  packet  according  to  the  selected 
bits  from  the  packet  head,  stream  reserved  would  not  be  a 
problem.  Since  many  researches  [15],  [16]  focus  on  how  to 


accelerate  the  packets  capturing  performance,  an  approach 
combination  packets  capture  and  stream  reassembly  is  cost- 
effective. 

(4)  NPU  often  has  a  well  designed  message-passing  mecha¬ 
nism  between  different  threads,  which  uses  cross-bar  structure 
or  fast  shared  SRAM  as  its  transferring  medium,  and  makes 
the  cooperation  and  synchronization  between  threads  facile. 

IV.  System  Architecture 

A.  Stream  in  TCP  Transferring  Level 

We  focus  on  three  different  critical  actions,  which  are  TCB 
creation  (the  point  at  which  an  IDS  decides  to  instantiate 
a  new  TCB  for  a  detected  connection).  Packet  Reorder(the 
process  an  NIDS  uses  to  reconstruct  a  stream  associated  with 
an  open  TCB),  and  TCB  Termination  (the  point  at  which 
the  IDS  decides  to  close  a  TCB).  Every  TCP  connection  can 
be  expressed  as  a  four-element  tuple  (which  includes  source 
IP,  source  port,  destination  IP,  and  destination  port).  Once  a 
packet  is  captured,  its  corresponding  stream  needs  to  be  found 
and  the  TCB  data  structure  needs  to  be  updated.  Basically, 
TCB  is  attached  to  a  Hash  Table  indexed  by  hash  algorithm 
using  some  bits  from  the  four-element  tuple  as  parameters. 
Collisions  lead  to  several  TCBs  attached  to  one  table  entry. 

B.  Frameworks  of  SRC 

The  framework  of  SRC  is  depicted  in  Figure.  2.  In  SRC, 
packets  are  captured  from  the  interfaces  to  the  memory;  for 
maintaining  the  TCP  connection  data,  a  hash  table  known  as 
Stream  Table  is  used.  When  the  packets  enter  the  memory, 
their  locations  are  stored  in  the  packet  descriptions.  Besides 
the  points  which  point  to  the  packets,  packet  descriptions  also 
contain  the  packet  length  and  the  fields  used  to  dispatch  the 
packets  to  the  threads. 

Threads  running  on  the  NPU  wait  circularly,  processing  a 
received  packet  and  then  waiting  for  another  packet.  Once  the 
data  needs  to  be  submitted,  every  thread  is  responsible  for  the 
task  of  submitting  the  packets  from  the  memory  of  the  NPU 
to  the  memory  of  the  host.  Both  the  softwares  running  on  the 
NPU  and  CPU  share  a  little  memory  space  in  the  DDR  of  the 
NPU  for  message  communication,  and  the  memory  space  is 
used  by  the  NPU  to  get  the  address  of  the  DMA,  the  timeout 
of  the  host  setting,  the  BlockSize,  and  the  consuming  states; 
CPU  can  also  use  the  memory  space  to  gain  the  running  states 
of  the  NPU.  As  the  packets  are  DMAed  to  the  host  memory, 
the  transferring  is  conducted  one  packet  after  another,  which  is 
due  to  the  packets  are  not  stored  consecutively  in  the  memory 
of  the  NPU  while  we  need  them  to  be  consecutive  when  they 
reach  the  memory  of  the  CPU. 

Software  running  on  the  NPU  mainly  executes  three  actions 
mentioned  in  Section.  IV-A:  TCB  Creation,  Packet  Reordering, 
and  TCB  Termination.  When  a  packet  reaches  one  core,  the 
related  thread  looks  up  the  Stream  Tables  to  determine  whether 
there  is  a  corresponding  TCB  exists.  If  not,  the  corresponding 
TCB  is  created,  and  the  packet  is  appended  to  the  TCB.  Or 
else,  the  packet  is  appended  to  the  corresponding  TCB  and  its 
link  position  is  determined;  meanwhile,  a  judgment  is  made 
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Fig.  2.  Frameworks  of  SRC. 

on  whether  the  total  packet  size  of  the  stream  is  equal  or 
larger  than  BlockSize  (Submitting  Block  Size).  If  the  answer 
is  positive,  all  the  packets  are  submitted  in  the  light  of  their 
sequence  to  the  Host. 

The  total  connection  records  are  maintained  in  a  hash  table 
called  Stream  Table  for  efficient  access.  Note  that  the  hash 
needs  to  be  independent  of  the  permutation  of  source  and 
destination  pairs,  which  could  be  achieved  by  comparison  the 
source  IP  together  with  source  port  and  destination  IP  together 
with  the  destination  port,  and  always  make  the  less  one  to  be 
the  first  parameter  or  using  some  hash  algorithms  that  are 
not  sensitive  to  the  sequence  of  parameters.  Using  such  hash 
values  as  the  indexes  to  the  stream  table,  the  corresponding 
connection  can  be  located.  Hash  collisions  can  be  resolved  by 
chaining  the  colliding  TCBs  in  a  linked  list. 

Data  submission  procedure  running  by  the  packet  process¬ 
ing  threads  needs  to  work  cooperatively  with  the  program 
running  on  the  host  CPU.  A  consecutive  memory  chunk  needs 
to  be  allocated  to  storage  the  packets  uploaded,  and  for  the 
convenience  of  the  packet  organization,  the  chunk  needs  to  be 
divided  into  fix-sized  buffers  which  are  organized  as  a  ring. 
Software  (IDS  and  NFS)  running  on  host  continually  process 
the  data  block  received. 

C.  The  Procedures  of  Stream  Reassembly 

The  two  significant  data  structures  in  stream  reassembly 
are  stream  table  and  TCB.  Stream  table  is  made  up  of  many 
entries,  each  of  which  points  to  a  list  of  TCBs  that  have  the 
same  hash  value.  In  SRC,  two  types  of  threads  are  used  to 
fulfill  the  stream  reassembly:  the  packet  processing  thread 
and  the  timeout  thread.  The  packet  processing  threads  are 
responsible  for  packet  receiving,  stream  reconstruction  and 
data  submission;  moreover,  stream  reconstruction  is  divided 
into  TCB  Creation,  Packet  Reordering  and  TCB  Termination. 
The  timeout  thread  is  a  simple  circular  procedure;  it  accesses 
TCBs  one  by  one  ceaselessly,  comparing  the  current  time  with 
the  time  of  the  last  coming  packet  in  every  stream.  If  the 
gap  between  the  two  times  is  large  than  the  appointed  value, 
timeout  thread  deems  that  the  corresponding  stream  may  be 
asleep  or  dead,  so  it  submits  the  remaining  data  and  delete  the 
TCB  to  give  space  to  other  streams. 

The  main  purpose  of  ReorderPacket  is  to  sort  the  one- 
stream-affiliated  packets  according  to  their  TCP  sequence 
number,  and  drop  the  repeated  packets  that  have  the  same 


sequence  number.  Instead  of  being  processed  after  a  batch 
of  packets  belonging  to  a  stream  have  been  received,  the 
packets  are  maintained  their  order  upon  being  received.  The 
reasons  why  it  does  in  this  way  are  as  follows:  (1)  The 
batch  processing  could  cause  the  computing  burst,  which  is 
detrimental  to  the  smooth  process;  (2)  Disordered  packets 
are  rare  actually,  most  of  the  arrived  packets  are  ordinal  and 
consecutive.  As  a  result,  processing  packets  one  by  one  will 
save  more  computational  resource. 

As  the  data  is  submitted  to  the  host,  all  the  packets  must 
be  insured  to  be  ordinal  and  consecutive.  We  use  ordering  to 
express  the  sequence  of  the  packet  and  continuity  to  denote  if 
there  is  any  packet  should  reach  but  have  not  reached.  When 
the  packets  reache,  their  ordering  can  be  insured  by  sorting 
the  sequence  number  and  modifying  the  points  of  the  list  that 
attached  packets,  but  the  continuity  cannot  be  ensured,  it  is  due 
to  the  disordered  arrival  is  available.  To  determine  if  the  data 
can  be  submitted,  a  counter  Discontinuity  Number  (DCN)  is 
used  to  identify  if  the  received  packets  is  continuous  or  not. 
DCN  is  the  counter  of  gaps  between  adjoining  packets  for  a 
stream. 

The  larger  the  DCN  is,  the  more  the  degree  of  discontinuity 
is.  An  example  is  given  as  follows:  for  one  direction  of  a 
stream,  if  packets  1,  2,  3,  4,  5,  and  7  have  been  received  (the 
numbers  are  the  order  numbers  of  the  packet  been  sent  out, 
not  the  sequence  numbers  of  the  TCP  level),  the  DCN  of  the 
stream  is  1,  because  there  is  a  gap  between  packet  5  and  packet 
7.  If  packets  I,  2,  3,  4,  and  7  have  been  received,  the  DCN 
of  the  stream  is  still  1,  because  even  through  there  are  two 
packets  between  packet  4  and  packet  7  as  they  look  like,  we 
do  not  know  there  is  one  packet  or  two  packets  can  fill  in  this 
gap  when  we  receive  the  packet  7,  the  only  fact  we  know  is 
that  there  is  a  gap  between  the  sequence  number  of  packet  4 
and  packet  7  from  TCP  level. 

All  the  packets  are  linked  up  while  the  packets  with  smaller 
sequence  number  are  in  the  front  of  the  link  and  the  packets 
with  bigger  sequence  number  are  at  the  back  of  the  link. 
Bidirectional  links  for  the  packets  are  needed,  because  packets 
needed  to  submitted  from  NPU  to  CPU  according  to  the 
sequence  number  of  the  packets.  But  when  a  packet  arrivals, 
locating  the  inserting  point  from  the  verse  direction  may  gain 
better  performance.  That  is  because  the  gap  exists  scarcely; 
and  even  when  it  emerges,  it  will  be  filled  up  quickly. 

When  a  stream  ends,  timeouts  or  its  size  exceeds  the 
BlockSize,  the  packets  belong  the  stream  must  be  uploaded  to 
the  CPU.  Under  the  circumstances  of  stream  end  or  timeout, 
DCN  will  be  zero  if  all  is  OK.  If  it  is  not  zero  for  some 
packets  have  not  been  received,  there  is  nothing  can  be 
done  by  the  reassembly  component.  But  if  we  are  under  the 
third  circumstance,  which  shows  that  the  size  of  the  stream 
achieves  the  BlockSize,  and  the  DCN  is  not  zero,  reassembly 
component  needs  to  find  the  gap  that  causing  the  DCN  to  be 
not  zero.  We  can  look  for  the  link  of  the  stream,  if  the  lost 
packets  are  far  from  the  last  packet  (for  example,  8  packets  is 
an  experiential  value),  the  finding  process  is  stopped  and  the 
packets  are  submitted,  considering  that  packets  will  not  arrive. 
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On  the  other  hand,  if  the  gap  is  among  the  last  8  packets,  we 
will  submit  the  integrated  packets  and  maintain  the  remanent 
inconsecutive  packets  of  the  stream.  To  sum  up,  we  try  to 
upload  the  packets  that  are  consecutive  to  the  host. 

V.  Improvement 

A.  Stream  Table  Dispatching  Technique 

There  are  two  techniques  can  be  implemented  to  organize 
the  TCB  in  the  stream  table;  shared  stream  table  and  separated 
stream  table.  For  the  shared  stream  table,  all  the  threads  share 
a  whole  stream  table,  so  all  the  threads  need  to  access  the 
stream  table  in  the  global  memory.  As  a  result,  a  lock  must 
be  added  to  the  corresponding  item  of  the  stream  table  when 
one  thread  is  processing  the  packet.  The  contest  accessing  by 
all  means  decrease  the  performance.  And  for  the  separated 
stream  table,  every  thread  uses  its  own  stream  table,  and  we 
must  use  more  memory  than  the  shared  stream  table  to  hold 
several  tables  to  make  the  TCB  list  not  too  long. 

So,  if  both  high  utilization  and  high  performance  are  re¬ 
quired,  a  new  technique  must  be  adopted.  To  solve  this  prob¬ 
lem  perfectly,  a  unified  hash  method  for  packet  dispatching 
to  the  threads  and  obtaining  the  stream  table  index  is  applied, 
making  all  the  TCBs  have  the  same  stream  table  index  are 
dispatched  to  the  same  thread.  Therefore,  the  items  of  the 
stream  table  need  not  to  append  locks  because  all  the  packets 
hashed  to  the  special  item  will  be  processed  by  one  special 
thread.  In  addition,  if  the  stream  table  items  assigned  to  every 
thread  are  consecutive  and  their  size  is  aligned  to  the  Cache 
blocks,  then  the  Cache  hit  ratio  will  be  high  to  improve  the 
overall  performance. 

B.  No-Locking  Timeout 

A  large  numbers  of  concurrent  TCP  streams  are  present  in 
the  network,  so  the  states  of  a  large  number  of  TCBs  attached 
to  the  stream  table  must  be  maintained.  To  release  the  memory 
space  of  the  streams  that  are  not  active  in  the  SRC,  three 
submission  schemas  have  been  used:  stream  timeout,  stream 
termination,  and  the  size  of  packet  buffered  achieve  a  specified 
size. 

Because  the  packets  timed  out  have  to  be  uploaded,  a 
separated  timeout  thread  is  used  to  confirm  whether  there  is 
any  stream  is  time  out.  The  timeout  thread  circularly  obtains 
every  item  in  the  stream  table  and  then  gains  every  TCB  in  the 
link  to  determinate  if  there  is  a  timeout.  If  a  timeout  occurs, 
submission  the  packets  and  deletion  the  TCB  are  conducted. 
The  stream  table  and  the  TCBs  become  the  critical  resources 
and  locks  are  required  because  that  the  packet  processing 
threads  need  to  process  on  the  TCBs  and  their  corresponding 
packets  as  same  as  the  timeout  thread  does. 

The  lock  operation  should  be  removed  as  our  experiences  on 
the  network  device  and  network  security  devices  because  we 
have  not  so  much  time  to  process  a  packet.  For  example,  we 
only  have  300  ms  to  process  a  packet  for  a  Gbps  link  [17].  For 
the  multi-cored  NPUs  of  RMI  and  OCTEON,  they  both  have 
a  fast  messaging  mechanism  to  implement  the  synchronization 
and  information  transformation  among  different  threads.  The 


messaging  mechanism  can  be  used  to  remove  the  locks  by  the 
timeout  thread  sending  a  message  to  the  packet  processing 
thread,  and  then  the  packet  processing  thread  submitting  the 
packets  and  deleting  the  TCBs. 

C.  Multi-channel  Virtual  Queue 

The  performance  of  the  Packet  capture  is  critical  to  the 
overall  traffic  analysis  system  [18],  [19];  similarly,  data  block 
submission  is  critical  to  the  overall  system  of  stream  reassem¬ 
bly.  It  is  obvious  that  multi-core  computers  are  the  current 
dominant  trend  in  computers;  thus,  how  to  avoid  data  coping 
and  make  the  data  block  distributed  to  the  several  cores  in 
the  host  evenly  can  bring  distinct  improvement  to  the  overall 
performance. 

Luca  [16]  exploits  the  feature  of  the  Intel  NIC,  but  he  has 
overtaken  that  packets  on  different  directions  for  one  stream 
will  be  dispatched  to  different  core  (Matching  Engineer),  many 
attacking  warnings  will  not  be  reported  for  this  reason.  We 
have  ever  amended  this  problem  by  allowing  the  driver  to 
re-compute  the  hash  value  if  the  source  address  is  bigger 
than  destination  address,  and  if  the  source  address  is  less  than 
destination  address,  hardware  distributing  mechanism  is  kept. 
But  it  impacts  the  performance,  although  it  is  stream  based, 
the  performance  of  the  method  is  only  60%  of  the  method  [16] 
introduced.  Eurthermore,  Intel  NIC  only  has  4  hxed  queues, 
but  the  latest  CPU  can  support  8  cores,  the  packets  in  4  queues 
cannot  be  dispatched  to  8  cores. 

The  host  creates  several  ringed  buffers,  and  tells  the  program 
running  on  the  embedded  multi-core  NPU  the  number  of 
ringed  buffers,  ring  descriptors,  length,  head  and  tail  pointers 
of  the  ring  through  shared  memory.  NPU  then  calculate 
the  corresponded  queue  that  each  stream  data  block  will  be 
dispatched  according  to  the  information  given  by  the  CPU. 

VI.  Implementation  and  Performance  Evaluation 
A.  Implementation 

A  Stream  Reassembly  Card  is  developed  using  XLS416 
produced  by  Raza  Microelectronics,  Inc  (RMI).  The  RMI 
XLS416  is  a  multi-core,  multi-thread  MIPS64  processor  with 
a  rich  set  of  integrated  I/O.  XLS  416  has  4  cores  and  every 
core  has  4  threads,  so  the  total  thread  number  is  16.  One 
thread  (referred  as  timeout  thread)  is  used  to  take  charge  of 
the  timeout  management,  and  the  other  threads  (referred  as 
packet  processing  threads)  all  execute  the  same  routine,  whose 
job  is  receiving  packets,  assembly,  and  submission,  when  the 
timeout  thread  find  that  any  stream  has  been  timed  out,  it 
will  send  a  message  to  the  corresponding  thread  to  notify 
which  stream  has  been  timed  out,  then  every  packet  processing 
thread  circularly  check  if  there  is  any  timeout  message  after 
processing  one  packet. 

XLS  416  has  three  frequency  models:  800M,  LOG  and 
1.2G;  for  the  best  of  the  performance,  we  used  the  XLS  with 
1.2G  Hz.  XLS  416  integrates  eight  Gigabit  Ethernet  or  two  Ten 
Gigabit  Ethernet.  To  further  save  the  PCB  size  and  consider 
that  the  Ten  Gigabit  Ethernet  may  be  the  mainstream  link  of 
the  campus  network,  2  ten-Gigabit  interfaces  are  adopted  to 
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SRC.  Our  SRC  has  4G  DRAM  with  533  MHz  and  1  PCIel.l 
X  4  Bus  used  to  connect  to  the  host.  The  interface  chip 
is  VSC8486-11  that  connect  the  fiber  module  and  the  XLS 
through  XAUI.  DIMM  chips  are  used  instead  of  DIMM  strips, 
for  it  occupies  less  PCB  space  and  the  stability  is  better.  The 
total  chip’s  power  consumption  is  under  26  watts. 

In  the  software  level,  there  are  a  stream  reassembly  program 
running  on  the  SRC  and  a  Driver  running  on  the  host.  Program 
running  on  the  SRC  is  bound  to  one  Image  with  the  RMI  OS 
and  is  burned  into  the  Flash,  which  is  also  used  to  boot  the 
system.  We  provide  an  SRC_API  extending  from  Libnids.  In 
addition  to  the  feature  of  the  Libnids,  our  SRC_API  can  be 
used  to  obtain  the  statistics  and  set  the  number  of  the  analyses 
threads  running  on  the  host,  timeout  of  the  stream,  and  the 
BlockSize.  2M  space  is  used  to  share  information  by  the  CPU 
and  NPU,  and  64M  byte  space  per  capturing  thread  running 
on  the  CPU. 

B.  Evaluation 

The  test  topology  is  depicted  in  Figure.  3.  Dell  PowerEdge 
R710  Server  with  an  Xeon  2.13Ghz  E5606  CPU,  and  total 
16GB  ECC  DDR3  (4x4GB)  is  used  to  host  the  SRC.  R710 
Server  has  a  PCIe  x  8  Bus  which  can  be  used  to  hold  the 
joint  of  the  SRC.  Red  Hat  Enterprise  Server  64Bit  with  a 
2.6.18-92.el5  kernel  is  used  as  the  Operation  System.  An  IXIA 
XM2  with  an  Xcellon-Ultra  NP  lOGbE  Load  Module  is  used 
to  construct  the  evaluation  environment.  The  application  level 
test  is  carried  out  by  IXIA  XM2  [20]. 

The  HTTP  is  used  as  the  traffic  load.  Two  XM2  ports  are 
used  to  emulate  the  traffic  between  one  server  and  multi¬ 
clients.  To  make  use  of  the  transferring  bandwidth  fully,  8 
capture  threads  in  the  host  are  used.  To  gain  the  relation¬ 
ship  between  the  NPU  core  number  and  stream  reassembly 
performance,  we  test  the  performance  under  different  core 
number  circumstance.  Since  every  core  has  4  threads,  when 
one  core  is  tested,  one  thread  is  used  as  timeout  thread  and  the 
other  3  threads  are  used  to  reorder  the  packets;  and  when  two 
cores  are  tested,  one  thread  is  used  as  timeout  thread  and  the 
other  7  threads  are  used  to  reorder  the  packets,  and  so  forth. 
Because  the  traditional  NIDS  used  Libnids  [8]  to  conduct  its 
stream  reassembly,  we  tested  its  performance  and  the  results 
are  depicted  in  the  last  column  of  Table.  I. 

More  cores  lead  to  higher  performance,  and  longer  packets 
produce  higher  performance.  It  is  also  revealed  that  if  all  the 
cores  are  used,  the  performance  is  close  to  that  of  the  packet 
capture.  It  means  that  when  all  the  threads  in  the  NPU  are 
turned  on  to  reassemble  the  packets,  the  performance  is  near  to 
the  PCI  transferring  ability,  so  it  can  be  inferred  that  if  the  PCI 
multiplying  factor  is  8,  the  performance  will  be  higher  than 
the  current  implementation.  As  we  know,  the  average  packet 
length  is  between  300  and  400  bytes,  so  the  performance  of 
the  real  environment  will  be  higher  than  3Gbps.  That  is  to 
say,  while  we  formerly  used  three  high  performance  server  to 
conduct  the  stream  reassembly,  now  one  SRC  can  accomplish 
the  same  task. 


IXIA  XM2 


Controller 


Fig.  3.  Stream  Reassembly  Performance  Test  Environment. 


TABLE  I 

Throughput  of  SRC  and  Libnids. 


Packet 

Length' 

1 

core 

2 

cores 

3 

cores 

4 

cores 

Libnids 

64 

0.22 

0.33 

0.61 

0.64 

0.45 

128 

0.25 

0.47 

0.98 

1.18 

0.48 

256 

0.59 

1.02 

2.50 

3.11 

0.82 

512 

0.75 

1.51 

2.66 

3.48 

0.93 

1024 

1.30 

2.73 

3.12 

3.70 

0.99 

1500 

1.45 

2.98 

3.11 

3.85 

1.21 

'  Unit:  Byte. 


VH.  Conclusion 

The  performance  of  TCP  packet  reassembly  becomes  the 
bottleneck  as  the  matching  performance  is  increasing.  In  this 
paper,  a  co-processing  stream  reassembly  framework  based 
on  multi-core  NPU  has  then  been  introduced  as  a  card,  so 
the  packet  capture  and  stream  reassembly  can  be  both  solved 
by  a  card.  And  to  heighten  the  performance,  we  brought 
forward  Stream  Table  Dispatching,  No-Locking  Timeout,  and 
Multi-channel  Virtual  Queue  to  improve  the  performance  of 
the  proposed  SRC  scheme.  The  solution  adopted  cannot  hold 
much  memory  because  the  size  and  electricity  limit,  whereas 
the  memory  size  is  critical  to  the  performance,  we  analyzed 
how  much  memory  is  need  for  a  specified  timeout,  block  size 
and  throughput.  Last,  RMI  XLS4I6  was  used  to  implement 
a  co-processing  Stream  Reassembly  Card,  The  result  showed 
that  our  scheme  is  about  3  times  of  Libnids  used  in  the  current 
predominant  server. 
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Figure  1C 
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REASSEMBLY-FREE  DEEP  PACKET 
INSPECTION  ON  MULTI-CORE  HARDWARE 

TECHNICAL  FIELD 

5 

The  present  invention  relates  to  intrusion  detection  and 
prevention  in  a  networked  system,  and  more  particularly,  to 
performing  multiple  packet  payloads  analysis  on  multi-core 
hardware. 

to 

BACKGROUND 

Today,  in  many  security  products,  scanning  by  pattern 
matching  is  used  to  prevent  many  types  of  security  attacks. 

For  example,  some  existing  desktop  virus  scanning  may 
include  scanning  files  against  certain  recognizable  patterns. 
These  files  may  come  from  mail  attachments  or  website 
downloads.  These  desktop  applications  are  simpler  in  that  by 
the  time  the  pattern  matching  is  performed,  the  input  has  been  jo 
all  accumulated  in  the  correct  order.  The  situation  is  more 
complicated  for  gateway  products,  such  as  firewalls,  attempt¬ 
ing  to  match  patterns  for  other  purposes.  Some  of  these  prod¬ 
ucts  scan  for  patterns  over  Transport  Control  Protocol  (TCP) 
packets.  Since  TCP  usually  breaks  down  application  data  into  25 
chunks  called  TCP  segments,  the  full  pattern  may  reside  in 
several  TCP  segments.  One  conventional  approach  is  to  reas¬ 
semble  all  TCP  packets  together  into  one  large  chunk  and 
perform  pattern  matching  on  this  chunk,  similar  to  scanning 
files.  The  disadvantage  of  this  approach  is  that  this  approach  30 
requires  processing  to  reassemble,  and  it  further  requires 
memory  to  buffer  the  intermediate  result  before  pattern 
matching  can  take  place. 

To  further  complicate  the  problem,  many  security  attacks 
exhibit  more  than  one  pattern,  and  thus,  multiple  pattern  35 
matching  has  to  be  performed  in  order  to  successfully  screen 
out  these  attacks.  Such  a  collection  of  patterns  is  called  a 
signature.  For  example,  an  attack  signamre  may  contain  a 
recognizable  header  and  a  particular  phrase  in  the  body.  To 
detect  such  an  attack,  the  detection  mechanism  has  to  match  40 
all  the  patterns  in  the  signature.  If  only  part  of  the  signature  is 
matched,  false  positives  may  occur.  As  such,  the  term  “attack 
pattern”  is  used  to  refer  to  a  single  pattern  or  a  signature. 

When  such  attacks  are  transported  over  TCP,  the  contents, 
and  therefore  the  recognizable  patterns,  may  exist  in  different  45 
TCP  segments.  In  fact,  even  a  single  pattern  is  often  split  over 
several  segments.  Therefore,  two  problems  have  to  be  solved 
at  the  same  time.  On  one  hand,  the  detection  mechanism  has 
to  scan  each  pattern  across  multiple  segments,  and  on  the 
other  hand,  the  detection  mechanism  also  has  to  scan  across  50 
patterns.  One  existing  approach  is  to  reassemble  all  packets 
and  scan  for  each  pattern  in  sequence.  This  approach  is  inef¬ 
ficient  in  terms  of  processing  time  and  memory  usage  because 
scanning  cannot  start  until  all  packets  are  received  and  reas¬ 
sembled  and  extra  memory  is  needed  to  store  the  packets  55 
received. 

Another  problem  in  pattern  matching  is  that  the  packets 
may  arrive  out  of  order.  Again,  using  TCP  as  an  example,  the 
application  data  is  broken  into  what  TCP  considers  the  best 
sized  chunks  to  send,  called  a  TCP  segment  or  a  TCP  packet.  60 
When  TCP  sends  a  segment,  it  maintains  a  timer  and  waits  for 
the  other  end  to  acknowledge  the  receipt  of  the  segment.  The 
acknowledgement  is  commonly  called  an  ACK.  If  an  ACK  is 
not  received  for  a  particular  segment  within  a  predetermined 
period  of  time,  the  segment  is  retransmitted.  Since  the  IP  layer  65 
transmits  the  TCP  segments  as  IP  datagrams  and  the  IP  data¬ 
grams  can  arrive  out  of  order,  the  TCP  segments  can  arrive  out 
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of  order  as  well.  Currently,  one  receiver  of  the  TCP  segments 
reassembles  the  data  so  that  the  application  layer  receives 
data  in  the  correct  order. 

An  existing  Intrusion  Detection/Prevention  System  (IPS) 
typically  resides  between  the  two  ends  of  TCP  communica¬ 
tion,  inspecting  the  packets  as  the  packets  arrive  at  the  IPS. 
The  IPS  looks  for  predetermined  patterns  in  the  payloads  of 
the  packets.  These  patterns  are  typically  application  layer 
patterns.  For  example,  the  pattern  might  be  to  look  for  the 
word  “windows.”  However,  the  word  may  be  broken  into  two 
TCP  segments,  e.g.,  “win”  in  one  segment  and  “dows”  in 
another  segment.  If  these  two  segments  arrive  in  the  correct 
order,  then  IPS  can  detect  the  word.  However,  if  the  segments 
arrive  out  of  order,  which  happens  relatively  often,  then  the 
IPS  may  first  receive  the  segment  containing  “dows”,  and 
have  to  hold  this  segment  and  wait  for  the  other  segment.  A 
typical  approach  is  for  the  IPS  to  force  the  sender  to  re¬ 
transmit  ail  the  segments  from  the  last  missing  one,  hoping 
that  the  segments  may  arrive  in  order  the  second  time.  One 
disadvantage  of  this  approach  is  the  additional  traffic  in 
between  and  the  additional  processing  on  both  ends  of  the 
TCP  communication. 

To  take  advantage  of  the  introduction  of  multi -core  proces¬ 
sors  (e.g.,  Intel®  Core™2  Quad  Processors  from  Intel  Cor¬ 
poration  of  Santa  Clara,  Calif),  some  conventional  ISPs  use 
multi-core  processors  to  scan  incoming  segments  to  speed  up 
the  process.  In  general,  each  multi -core  processor  has  two  or 
more  processing  cores.  According  to  one  conventional 
approach,  one  of  the  processing  cores  is  used  to  completely 
reassemble  the  file  while  the  remaining  processing  cores  per¬ 
form  scanning  or  pattern  matching  in  the  background  after  the 
file  has  been  completely  reassembled.  However,  this 
approach  does  not  scale  in  terms  of  having  enough  memory  to 
store  all  files.  Also,  background  scanning  by  multiple  pro¬ 
cessing  cores  is  less  efficient  due  to  extra  memory  copying 
overhead  and  extra  scheduling  processing  overhead. 

BRIEF  DESCRIPTION  OF  THE  DRAWINGS 

The  present  invention  is  illustrated  by  way  of  example,  and 
not  by  way  of  limitation,  in  the  figures  of  the  accompanying 
drawings  and  in  which; 

FIG.  lA  illustrates  one  embodiment  of  a  method  to  per¬ 
form  multiple  packet  analysis  on  multi-core  hardware. 

FIG.  IB  illustrates  an  alternate  embodiment  of  amethodto 
perform  multiple  packet  analysis  on  multi-core  hardware. 

FIG.  IC  illustrates  one  embodiment  of  a  method  to  perform 
deep  packet  inspection. 

FIG.  2  illustrates  an  exemplary  Deterministic  Finite 
Automaton  (DFA)  according  to  one  embodiment  of  the 
invention. 

FIG.  3  illustrates  a  functional  block  diagram  of  one 
embodiment  of  multi-core  hardware  usable  to  perform  mul¬ 
tiple  packet  analysis. 

FIG.  4  illustrates  one  embodiment  of  a  system  in  which 
embodiments  of  the  present  invention  may  be  implemented. 

FIG.  5  illustrates  a  block  diagram  of  an  exemplary  com¬ 
puter  system,  in  accordance  with  one  embodiment  of  the 
present  invention. 

DETAILED  DESCRIPTION 

Described  herein  are  some  embodiments  of  reassembly- 
free  deep  packet  inspection  on  multi-core  hardware.  In  one 
embodiment,  a  set  of  packets  of  one  or  more  files  is  received 
at  a  networked  device  from  one  or  more  connections.  Each 
packet  is  scanned  using  one  of  a  set  of  processing  cores  in  the 
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networked  device  without  buffering  the  one  or  more  files  in 
the  networked  device.  Furthermore,  the  set  of  processing 
cores  may  scan  the  packets  substantially  concurrently. 

In  the  following  description,  numerous  details  are  set  forth. 

It  will  be  apparent,  however,  to  one  skilled  in  the  art,  that  the  5 
present  invention  may  be  practiced  without  these  specific 
details.  In  some  instances,  well-known  structures  and  devices 
are  shown  in  block  diagram  form,  rather  than  in  detail,  in 
order  to  avoid  obscuring  the  present  invention. 

Some  portions  of  the  detailed  descriptions  below  are  pre-  to 
sented  in  terms  of  algorithms  and  symbolic  representations  of 
operations  on  data  bits  within  a  computer  memory.  These 
algorithmic  descriptions  and  representations  are  the  means 
used  by  those  skilled  in  the  data  processing  arts  to  most 
effectively  convey  the  substance  of  their  work  to  others  15 
skilled  in  the  art.  An  algorithm  is  here,  and  generally,  con¬ 
ceived  to  be  a  self-consistent  sequence  of  steps  leading  to  a 
desired  result.  The  steps  are  those  requiring  physical  manipu¬ 
lations  of  physical  quantities.  Usually,  though  not  necessarily, 
these  quantities  take  the  form  of  electrical  or  magnetic  signals  20 
capable  of  being  stored,  transferred,  combined,  compared, 
and  otherwise  manipulated.  It  has  proven  convenient  at  times, 
principally  for  reasons  of  conunon  usage,  to  refer  to  these 
signals  as  bits,  values,  elements,  symbols,  characters,  terms, 
numbers,  or  the  like.  25 

It  should  be  borne  in  mind,  however,  that  all  of  these  and 
similar  terms  are  to  be  associated  with  the  appropriate  physi¬ 
cal  quantities  and  are  merely  convenient  labels  applied  to 
these  quantities.  Unless  specifically  stated  otherwise  as 
apparent  from  the  following  discussion,  it  is  appreciated  that  30 
throughout  the  description,  discussions  utilizing  terms  such 
as  “processing”  or  “computing”  or  “calculating”  or  “deter¬ 
mining”  or  “displaying”  or  the  like,  refer  to  the  action  and 
processes  of  a  computer  system,  or  similar  electronic  com¬ 
puting  device,  that  manipulates  and  transforms  data  repre-  35 
sented  as  physical  (electronic)  quantities  within  the  computer 
system’s  registers  and  memories  into  other  data  similarly 
represented  as  physical  quantities  within  the  computer  sys¬ 
tem  memories  or  registers  or  other  such  information  storage, 
transmission  or  display  devices.  40 

The  present  invention  also  relates  to  apparatus  for  perform¬ 
ing  the  operations  herein.  This  apparatus  may  be  specially 
constructed  for  the  required  purposes,  or  it  may  comprise  a 
general-purpose  computer  selectively  activated  or  reconfig¬ 
ured  by  a  computer  program  stored  in  the  computer.  Such  a  45 
computer  program  may  be  stored  in  a  computer-readable 
storage  medium,  such  as,  but  is  not  limited  to,  any  type  of  disk 
including  floppy  disks,  optical  disks,  CD-ROMs,  and  mag¬ 
netic-optical  disks,  read-only  memories  (ROMs),  random 
access  memories  (RAMs),  EPROMs,  EEPROMs,  flash  50 
memory,  magnetic  or  optical  cards,  or  any  type  of  media 
suitable  for  storing  electronic  instructions,  and  each  coupled 
to  a  computer  system  bus. 

The  algorithms  and  displays  presented  herein  are  not  inher¬ 
ently  related  to  any  particular  computer  or  other  apparatus.  55 
Various  general-purpose  systems  may  be  used  with  programs 
in  accordance  with  the  teachings  herein,  or  it  may  prove 
convenient  to  construct  more  specialized  apparatus  to  per¬ 
form  the  required  method  steps.  The  required  structure  for  a 
variety  of  these  systems  will  appear  from  the  description  60 
below.  In  addition,  the  present  invention  is  not  described  with 
reference  to  any  particular  programming  language.  It  will  be 
appreciated  that  a  variety  of  programming  languages  may  be 
used  to  implement  the  teachings  of  the  invention  as  described 
herein.  65 

FIG.  lA  illustrates  one  embodiment  of  a  method  to  per¬ 
form  multiple  packet  analysis  on  multi -core  hardware,  where 
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multiple  processing  cores  of  a  set  of  processing  cores  are 
allowed  to  handle  packets  from  the  same  connection  (herein¬ 
after,  “connection  X”).  In  some  embodiments,  the  set  of  pro¬ 
cessing  cores  includes  processing  cores  of  a  multi-core  pro¬ 
cessor.  The  method  may  be  performed  by  processing  logic 
that  may  comprise  hardware  (e.g.,  circuitry,  dedicated  logic, 
programmable  logic,  processing  cores,  etc.),  software  (such 
as  instructions  run  on  a  processing  core),  firmware,  or  a 
combination  thereof. 

Initially,  one  of  a  set  of  processing  cores  receives  a  packet 
from  connection  X  (processing  block  110).  The  packet  is  part 
of  a  file,  which  may  be  re-constructed  by  re-assembling  the 
packet  with  other  packets  of  the  file.  Then  the  processing  core 
determines  if  the  packet  is  in-order  (processing  block  112). 
For  example,  the  processing  core  may  check  a  sequence  num¬ 
ber  in  a  header  of  the  packet  against  a  next  packet  sequence 
nmnber  of  connection  X,  which  may  be  stored  in  a  database 
cormnonly  accessible  by  the  processing  cores. 

If  the  packet  is  not  in-order,  i.e.,  out-of-order,  then  the 
processing  core  may  buffer  the  packet  in  an  out-of-order 
buffer  associated  with  connection  X  (processing  block  114). 
The  processing  core  may  allow  the  packet  to  pass  (processing 
block  115).  Then  the  processing  core  waits  for  another  new 
incoming  packet  (processing  block  120). 

If  the  packet  is  in-order,  then  the  processing  core  performs 
deep  packet  inspection  (DPI)  on  the  packet  (processing  block 
116).  Details  of  some  embodiments  of  DPI  are  discussed 
below.  Then  the  processing  core  checks  if  there  is  any  packet 
in  the  out-of-order  buffer  associated  with  connection  X  that 
recently  became  in-order  (processing  block  118).  If  there  is 
no  packet  in  the  out-of-order  buffer  associated  with  connec¬ 
tion  X  that  is  next  in  sequence  (in-order),  the  processing  core 
transitions  to  processing  block  120  to  wait  for  another  new 
incoming  packet.  Otherwise,  if  there  is  a  packet  in  the  out- 
of-order  buffer  associated  with  connection  X  that  is  now 
in-order,  then  the  processing  core  removes  this  packet  and 
performs  DPI  on  this  packet  (processing  block  122).  When 
the  processing  core  completes  DPI  on  this  packet,  the  pro¬ 
cessing  core  returns  to  processing  block  118  to  check  if  there 
is  another  packet  in  the  out-of-order  buffer  associated  with 
connection  X  that  is  in-order. 

Note  that  the  incoming  packets  are  scanned  without  buff¬ 
ering  the  file  for  reassembly  because  the  packets  can  be 
inspected  for  the  predetermined  pattern  without  being  reas¬ 
sembled  into  the  file.  Thus,  the  above  technique  is  well  suited 
for  IPSs  that  have  limited  capacity  for  buffering  or  storage. 
Furthermore,  the  above  technique  allows  the  set  of  processing 
cores  to  scan  incoming  packets  substantially  concurrently. 
Therefore,  the  speed  of  the  scanning  may  be  improved  over 
conventional  approaches. 

FIG.  IB  illustrates  one  embodiment  of  a  method  to  perform 
multiple  payload  analysis  on  multi-core  hardware,  where 
only  a  single  core  in  a  set  of  processing  cores  is  allowed  to 
handle  packets  from  a  particular  connection  (hereinafter, 
“connection  X”)  at  a  time.  In  some  embodiments,  the  set  of 
processing  cores  includes  processing  cores  of  a  multi-core 
processor.  The  method  may  be  performed  by  processing  logic 
that  may  comprise  hardware  (e.g.,  circuitry,  dedicated  logic, 
programmable  logic,  processing  cores,  etc.),  software  (such 
as  instructions  run  on  a  processing  core),  firmware,  or  a 
combination  thereof. 

Initially,  one  processing  core  of  the  set  of  processing  cores 
receives  a  packet  from  connection  X  (processing  block  130). 
Then  the  processing  core  checks  if  there  is  another  processing 
core  in  the  set  of  processing  cores  handling  another  packet 
from  coimection  X  (processing  block  132).  If  there  is  another 
processing  core  handling  another  packet  from  connection  X 
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currently,  then  the  processing  core  postpones  handling  of  this 
packet  until  the  other  processing  core  is  done  with  the  other 
packet  from  connection  X  (processing  block  134).  The  pro¬ 
cessing  core  may  transition  to  processing  block  144  to  wait 
for  another  new  incoming  packet.  5 

If  the  processing  core  determines  that  there  is  no  other 
processing  core  in  the  set  of  processing  cores  handling 
another  packet  from  connection  X,  then  the  processing  core 
checks  if  this  packet  is  in-order  (processing  block  136).  If  this 
packet  is  not  in-order,  i.e.,  out-of-order,  then  the  processing  to 
core  buffers  this  packet  in  an  out-of-order  buffer  associated 
with  connection  X  (processing  block  140).  The  processing 
core  may  allow  this  packet  to  pass  (processing  block  142). 
Then  the  processing  core  waits  for  another  new  incoming 
packet  (processing  block  144).  15 

If  the  processing  core  determines  that  this  packet  is  in- 
order,  then  the  processing  core  performs  DPI  on  this  packet 
(processing  block  138).  Details  of  some  embodiments  of  DPI 
are  discussed  below.  After  performing  DPI  on  the  packet,  the 
processing  core  checks  if  there  is  any  packet  in  the  out-of-  20 
order  buffer  associated  with  connection  X,  which  is  now 
in-order  (processing  block  146).  If  there  is  a  packet  in  the 
out-of-order  buffer  that  is  now  in-order,  then  the  processing 
core  removes  the  packet  that  recently  became  in-order  from 
the  out-of-order  buffer  and  performs  DPI  on  this  packet  (pro-  25 
cessing  block  148).  Then  the  processing  core  returns  to  pro¬ 
cessing  block  146  to  repeat  the  above  process.  If  there  is  no 
packet  in  the  out-of-order  buffer  that  is  in-order,  then  the 
processing  core  transitions  to  processing  block  144  to  wait  for 
another  new  incoming  packet.  30 

Like  the  technique  illustrated  in  FIG.  lA,  the  technique 
illustrated  in  FIG.  IB  also  allows  scanning  of  the  incoming 
packets  without  buffering  the  file  for  reassembly  because  the 
packets  can  be  scanned  for  the  predetermined  pattern,  without 
reassembling  the  packets  into  the  file,  by  DPI.  35 

FIG.  1C  illustrates  one  embodiment  of  a  method  to  perform 
deep  packet  inspection  (DPI)  using  one  of  a  set  of  processing 
cores.  In  some  embodiments,  the  set  of  processing  cores 
includes  processing  cores  of  a  multi-core  processor.  The 
method  may  be  performed  by  processing  logic  that  may  com-  40 
prise  hardware  (e.g.,  circuitry,  dedicated  logic,  program¬ 
mable  logic,  processing  cores,  etc.),  software  (such  as 
instructions  run  on  a  processing  core),  firmware,  or  a  combi¬ 
nation  thereof. 

Initially,  the  processing  core  starts  DPI  on  a  packet  from  45 
connection  X  at  block  150.  This  packet  is  hereinafter  referred 
to  as  the  current  packet.  The  processing  core  performs  pattern 
matching  on  the  current  packet  from  the  last  stored  state  of 
pattern  matching  for  connection  X  (processing  block  152). 
Specifically,  the  processing  core  is  trying  to  look  for  a  prede-  50 
termined  pattern  or  signature  in  the  incoming  packets,  which 
may  be  associated  with  a  computer  virus  or  malicious  code. 

By  identifying  such  pattern  or  signature  in  the  incoming 
packets  and  blocking  at  least  one  of  the  packets  containing 
part  of  the  predetermined  pattern  or  signature,  the  set  of  55 
processing  cores  can  protect  a  system  from  computer  viral 
attack.  In  some  embodiments,  the  last  stored  state  of  pattern 
matching  for  connection  X  is  stored  in  a  database  commonly 
accessible  by  the  set  of  processing  cores.  As  such,  each  of  the 
set  of  processing  cores  can  handle  packets  from  connection  60 
X,  even  though  some  of  the  packets  may  be  inspected  by 
different  processing  cores. 

In  some  embodiments,  if  there  is  a  match  between  a  pre¬ 
determined  pattern  and  the  data  pattern  in  the  incoming  pack¬ 
ets  inspected  so  far  (which  includes  the  current  packet),  then  65 
the  processing  core  blocks  the  current  packet  (processing 
block  160).  Then  the  processing  core  may  issue  an  alarm  to 
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warn  a  system  administrator  of  detection  of  potentially  mali¬ 
cious  code  or  virus  in  the  incoming  packets  (processing  block 
162),  and  the  process  ends  at  block  164. 

If  there  is  no  match  between  the  predetermined  pattern  and 
the  data  pattern  in  the  incoming  packets  inspected  so  far,  then 
the  processing  core  may  update  and  store  the  current  state  of 
pattern  matching  of  connection  X  in  the  database  (processing 
block  156).  The  method  then  ends  at  block  158. 

In  some  embodiments,  pattern  matching  performed  in  DPI 
is  accomplished  using  Deterministic  Finite  Automaton 
(DFA).  An  exemplary  DFA  is  shown  in  FIG.  2  to  illustrate  the 
concept. 

FIG.  2  illustrates  an  exemplary  DFA  according  to  one 
embodiment  of  the  invention.  In  this  example,  an  IPS  is 
programmed  to  detect  and  to  prevent  a  pattern  of  “01 H”  to 
pass  through.  The  DFA  200  shown  in  FIG.  2  corresponds  to 
this  pattern.  A  set  of  processing  cores  may  use  the  DFA  200  to 
perform  pattern  matching  on  a  number  of  packets  to  deter¬ 
mine  whether  the  packets  contain  the  pattern  “01 1 1  ”.  Further¬ 
more,  to  simplify  the  illustration,  it  is  assumed  in  this  example 
that  each  packet  contains  only  one  digit.  However,  it  should 
be  appreciated  that  the  concept  is  applicable  to  scenarios 
where  a  packet  contains  more  than  one  digits  and/or  alpha¬ 
betic  letters. 

Referring  to  FIG.  2,  the  DFA  200  includes  5  states  211- 
219.  The  states  211-219  in  the  DFA  200  may  be  referred  to  as 
nodes.  A  processing  core  in  the  set  of  processing  cores  begins 
pattern  matching  at  the  initial  state  211.  If  a  packet  received 
contains  a  “  1  ”,  the  processing  core  remains  in  the  initial  state 
211.  If  the  packet  contains  a  “0”,  wliich  corresponds  to  the 
first  digit  in  the  predetermined  pattern,  the  processing  core 
transitions  to  the  A  state  213. 

If  the  processing  core  receives  a  “0”  subsequently,  the 
processing  core  remains  in  the  A  state  213.  If  the  processing 
core  receives  a  “1”,  which  corresponds  to  the  second  digit  in 
the  predetermined  pattern,  then  the  processing  core  transi¬ 
tions  into  the  B  state  215.  From  the  B  state  215,  the  processing 
core  may  transition  back  to  the  A  state  213  if  the  next  packet 
received  contains  a  “0”.  If  the  next  packet  received  contains  a 
“  1  ”,  which  corresponds  to  the  third  digit  in  the  predetermined 
pattern,  then  the  processing  core  transitions  to  the  C  state  217. 
However,  note  that  another  processing  core  in  the  set  of 
processing  cores  may  receive  and  process  the  next  packet  in 
some  embodiments. 

From  the  C  state  217,  the  processing  core  may  transition 
back  to  the  A  state  213  if  the  next  packet  received  contains  a 
“0”.  If  the  next  packet  received  contains  a  “I”,  which  corre¬ 
sponds  to  the  last  digit  in  the  predetermined  pattern,  then  the 
processing  core  transitions  to  the  final  state  219.  When  the 
processing  core  reaches  the  final  state  219,  the  processing 
core  knows  that  the  packets  received  so  far  contain  the  pre¬ 
determined  pattern.  Hence,  the  processing  core  may  perform 
the  appropriate  operations  in  response  to  receiving  the  pre¬ 
determined  pattern,  such  as  blocking  the  packet  of  the  prede¬ 
termined  pattern  last  received  and  issuing  an  alarm  to  alert 
system  administrators.  To  keep  track  of  which  state  of  the 
DFA  is  in  currently,  the  processing  core  stores  the  current 
state  of  the  DFA  in  a  database  commonly  accessible  by  the  set 
of  processing  cores.  As  such,  another  processing  core  may 
continue  pattern  matching  on  the  next  packet  from  the  current 
state  if  the  other  processing  core  receives  the  next  packet. 
Furthermore,  the  current  state  of  the  DFA  may  be  associated 
with  a  connection  from  which  the  packet  is  received  so  that 
the  set  of  processing  cores  may  inspect  packets  from  multiple 
connections  using  the  information  from  the  database. 

One  advantage  of  using  the  DFA  to  perform  pattern  match¬ 
ing  on  packets  is  to  eliminate  the  need  to  reassemble  the 
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packets  because  the  processing  cores  can  walk  through  the 
DFA  as  each  packet  is  received  and  examined.  Because  a 
pattern  is  typically  broken  up  into  a  number  of  segments  and 
each  segment  is  transmitted  using  a  packet,  it  is  necessary  to 
inspect  multiple  packets  in  order  to  identify  the  pattern.  Using  5 
the  DFA,  the  processing  cores  may  not  have  to  reassemble  the 
packets  in  order  to  find  out  what  the  pattern  contained  in  the 
packets  is  in  order  to  match  the  pattern  against  a  predeter¬ 
mined  pattern.  The  processing  cores  may  perform  pattern 
matching  on  a  packet -by-packet  basis  as  each  of  the  packets  is  to 
received  without  reassembling  the  packets  by  walking 
through  the  DFA.  If  a  processing  core  reaches  a  final  state, 
there  is  a  match  between  the  pattern  contained  in  the  packets 
received  so  far  and  the  predetermined  pattern.  There  is  no 
need  to  store  the  packets  for  reassembling  the  packets.  15 
Instead,  the  processing  cores  may  simply  store  the  current 
state  of  the  DFA  in  a  database  commonly  accessible  by  the 
processing  cores. 

The  concept  described  above  may  be  expanded  to  signature 
detection.  A  signature  is  a  collection  of  multiple  patterns.  To  20 
keep  track  of  which  pattern  within  a  signature  is  being 
matched,  processing  logic  may  use  a  tree  structure,  where 
each  node  within  the  tree  structure  corresponds  to  a  pattern 
and  each  pattern  is  represented  using  a  DFA.  Alternatively,  a 
single  DFA  may  represent  multiple  patterns.  25 

FIG.  3  illustrates  a  functional  block  diagram  of  one 
embodiment  of  multi-core  hardware  usable  to  perform  mul¬ 
tiple  payload  analysis  in  an  IPS.  The  IPS  may  be  implemented 
within  a  set-top  box  coupled  to  a  protected  network.  The 
multi-core  hardware  300  includes  a  set  of  processing  cores  30 
310,  a  pattern  matching  database  320,  and  an  out-of-order 
buffer  330.  In  some  embodiments,  the  set  of  processing  cores 
310  includes  processing  cores  in  a  multi-core  processor.  The 
processing  cores  310  are  communicably  coupled  to  the  data¬ 
base  320  so  that  each  of  the  processing  cores  310  may  retrieve  35 
and  update  information  in  the  database  320.  Likewise,  the 
processing  cores  310  are  also  communicably  coupled  to  the 
out-of-order  buffer  330  so  that  each  of  the  processing  cores 
310  may  access  the  out-of-order  buffer  330. 

In  some  embodiments,  the  processing  cores  310  receive  40 
packets  from  one  or  more  connections.  To  prevent  harmfiil 
virus  or  malicious  code  from  reaching  the  protected  network, 
the  processing  cores  310  performs  reassembly-free  DPI  on 
the  packets.  When  one  of  the  processing  cores  310  receives  a 
packet,  the  processing  core  may  determine  if  the  packet  is  45 
in-order  or  out-of-order.  An  out-of-order  packet  may  be  tem¬ 
porarily  stored  in  the  out-of-order  buffer  330  and  be  associ¬ 
ated  with  the  connection  from  which  the  out-of-order  packet 
is  received.  In-order  packets  are  examined  by  the  processing 
cores  310  and  are  allowed  to  pass  to  the  protected  network  if  50 
no  pattern  of  harmful  virus  or  malicious  code  is  detected.  The 
processing  cores  310  update  and  store  the  current  pattern 
matching  state  of  each  connection  in  the  database  320.  As 
such,  any  one  of  the  processing  cores  310  can  continue  with 
the  on-going  pattern  matching  from  the  current  state  of  a  55 
connection  that  sends  the  current  packet.  In  some  embodi¬ 
ments,  the  database  320  includes  a  relational  database  that 
stores  the  current  pattern  matching  states  324  with  their  cor¬ 
responding  connections  322  as  shown  in  FIG.  2.  Details  of 
some  embodiments  of  the  method  to  perform  reassembly -free  60 
DPI  have  been  discussed  above. 

FIG.  4  illustrates  one  embodiment  of  a  system  in  which 
embodiments  of  the  present  invention  may  be  implemented. 

The  system  400  includes  a  client  machine  412  within  a  pro¬ 
tected  network  410,  an  IPS  420,  and  a  network  430.  The  65 
protected  network  410  is  communicably  coupled  to  the  net¬ 
work  430  via  the  IPS  420.  Thus,  packets  transmitting  between 
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the  protected  network  410  and  the  network  430  have  to  pass 
through  the  IPS  420.  In  some  embodiments,  there  may  be 
more  than  one  client  machines  coupled  to  the  protected  net¬ 
work  410.  The  network  430  may  include  a  variety  of  net¬ 
works,  such  as  local  area  network  (LAN),  wide  area  network 
(WAN),  etc.  Furthermore,  the  network  430  may  be  publicly 
accessible,  and  therefore,  computer  virus  and  malicious  code 
targeting  the  protected  network  410  may  be  sent  from  the 
network  430 .  As  such,  the  IPS  420  scans  the  incoming  packets 
to  prevent  computer  virus  and  malicious  code  from  entering 
the  protected  network  410. 

In  some  embodiments,  the  IPS  420  includes  a  multi-core 
processor  421,  an  out-of-order  buffer  423,  and  a  pattern 
matching  database  425.  The  multi-core  processor  421 
includes  a  set  of  processing  cores,  such  as  the  processing 
cores  310  shown  in  FIG.  3. 

In  some  embodiments,  each  of  the  processing  cores 
receives  packets  from  the  network  430  through  different  con¬ 
nections.  Furthermore,  the  packets  may  arrive  out-of-order, 
and  if  so,  the  out-of-order  packets  may  be  temporarily  stored 
in  the  out-of-order  buffer  423  to  be  inspected  later.  The  pro¬ 
cessing  cores  of  the  multi-core  processor  421  perform  DPI  on 
the  in-order  packets  and  store  the  current  pattern  matching 
states  of  the  connections  in  the  pattern  matching  database 
425.  If  a  pattern  associated  with  computer  virus  or  malicious 
code  is  identified  in  the  incoming  packets  inspected  so  far,  the 
multi-core  processor  421  blocks  the  packet  currently  being 
inspected  and  may  further  issue  a  warning  to  a  system  admin¬ 
istrator.  If  no  pattern  associated  with  computer  virus  or  mali¬ 
cious  code  is  identified  in  the  incoming  packets  inspected  so 
far,  then  the  multi-core  processor  421  allows  the  packet  cur¬ 
rently  being  inspected  to  pass  to  the  protected  network  410, 
which  may  be  fitrther  transmitted  to  the  client  machine  412. 
By  blocking  the  packet  currently  being  inspected  if  the  pat¬ 
tern  is  identified  in  the  packets  received  so  far,  the  computer 
virus  or  malicious  code  cannot  be  completely  passed  into  the 
protected  network  410.  and  hence,  the  computer  virus  or 
malicious  code  cannot  be  completely  reassembled  on  the 
client  machine  412.  The  incomplete  computer  virus  or  mali¬ 
cious  code  typically  cannot  harm  the  client  machine  412 
coupled  thereto.  Details  of  some  embodiments  of  a  method  to 
perform  reassembly-free  DPI  have  been  discussed  above. 

FIG.  5  illustrates  a  diagrammatic  representation  of  a 
machine  in  the  exemplary  form  of  a  computer  system  500 
within  which  a  set  of  instructions,  for  causing  the  machine  to 
perform  any  one  or  more  of  the  methodologies  discussed 
herein,  may  be  executed.  In  alternative  embodiments,  the 
machine  may  be  connected  (e.g.,  networked)  to  other 
machines  in  a  LAN,  an  intranet,  an  extranet,  and/or  the  Inter¬ 
net.  The  machine  may  operate  in  the  capacity  of  a  server  or  a 
client  machine  in  client-server  network  environment,  or  as  a 
peer  machine  in  a  peer-to-peer  (or  distributed)  network  envi¬ 
ronment.  The  machine  may  be  a  personal  computer  (PC),  a 
tablet  PC,  a  set-top  box  (STB),  a  Personal  Digital  Assistant 
(PDA),  a  cellular  telephone,  a  web  appliance,  a  server,  a 
network  router,  a  switch  or  bridge,  or  any  machine  capable  of 
executing  a  set  of  instructions  (sequential  or  otherwise)  that 
specify  actions  to  be  taken  by  that  machine.  Further,  while 
only  a  single  machine  is  illustrated,  the  term  “machine”  shall 
also  be  taken  to  include  any  collection  of  machines  that  indi¬ 
vidually  or  jointly  execute  a  set  (or  multiple  sets)  of  instruc¬ 
tions  to  perform  any  one  or  more  of  the  methodologies  dis¬ 
cussed  herein. 

The  exemplary  computer  system  500  includes  a  processing 
device  502,  a  main  memory  504  (e.g.,  read-only  memory 
(ROM),  flash  memory,  dynamic  random  access  memory 
(DRAM)  such  as  synchronous  DRAM  (SDRAM)  or  Rambus 
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DRAM  (RDRAM),  etc.),  a  static  memory  506  (e.g.,  flash 
memory,  static  random  access  memory  (SRAM),  etc.),  and  a 
data  storage  device  518,  which  communicate  with  each  other 
via  a  bus  532. 

Processing  device  502  represents  one  or  more  general-  5 
purpose  processing  devices  such  as  a  microprocessor,  a  cen¬ 
tral  processing  unit,  or  the  like.  More  particularly,  the  pro¬ 
cessing  device  may  be  complex  instruction  set  computing 
(CISC)  microprocessor,  reduced  instruction  set  computing 
(RISC)  microprocessor,  very  long  instruction  word  (VLIW) 
microprocessor,  or  processor  implementing  other  instruction 
sets,  or  processors  implementing  a  combination  of  instruction 
sets.  Processing  device  502  may  also  be  one  or  more  special- 
purpose  processing  devices  such  as  an  application  specific 
integrated  circuit  (ASIC),  a  field  programmable  gate  array 
(FPGA),  a  digital  signal  processor  (DSP),  network  processor, 
or  the  like.  The  processing  device  502  is  configured  to  execute 
the  processing  logic  526  for  performing  the  operations  and 
steps  discussed  herein.  20 

The  computer  system  500  may  further  include  a  network 
interface  device  508.  The  computer  system  500  also  may 
include  a  video  display  unit  510  (e.g.,  a  liquid  crystal  display 
(LCD)  or  a  cathode  ray  tube  (CRT)),  an  alphanumeric  input 
device  512  (e.g.,  a  keyboard),  a  cursor  control  device  514  25 
(e.g.,  a  mouse),  and  a  signal  generation  device  516  (e.g.,  a 
speaker). 

The  data  storage  device  518  may  include  a  machine-acces¬ 
sible  storage  medium  530  (also  known  as  a  machine-readable 
storage  medium  or  a  computer-readable  medium)  on  which  is 
stored  one  or  more  sets  of  instructions  (e.g.,  software  522) 
embodying  any  one  or  more  of  the  methodologies  or  func¬ 
tions  described  herein.  The  software  522  may  also  reside, 
completely  or  at  least  partially,  within  the  main  memory  404 
and/or  within  the  processing  device  502  during  execution 
thereof  by  the  computer  system  500,  the  main  memory  504 
and  the  processing  device  502  also  constituting  machine- 
accessible  storage  media.  The  software  522  may  further  be 
transmitted  or  received  over  a  network  520  via  the  network  40 
interface  device  508. 

While  the  machine-accessible  storage  medium  530  is 
shown  in  an  exemplary  embodiment  to  be  a  single  medium, 
the  term  “machine-accessible  storage  medium”  should  be 
taken  to  include  a  single  medium  or  multiple  media  (e.g.,  a  45 
centralized  or  distributed  database,  and/or  associated  caches 
and  servers)  that  store  the  one  or  more  sets  of  instructions. 
The  term  “machine-accessible  storage  medium”  shall  also  be 
taken  to  include  any  medium  that  is  capable  of  storing,  encod¬ 
ing  or  carrying  a  set  of  instructions  for  execution  by  the 
machine  and  that  cause  the  machine  to  perform  any  one  or 
more  of  the  methodologies  of  the  present  invention.  The  term 
“machine-accessible  storage  medium”  shall  accordingly  be 
taken  to  include,  but  not  be  limited  to,  solid-state  memories, 
optical  and  magnetic  media,  etc.  In  some  embodiments, 
machine-accessible  storage  medium  may  also  be  referred  to 
as  computer-readable  storage  medium. 

Thus,  some  embodiments  of  reassembly-free  DPI  on 
multi-core  hardware  have  been  described.  It  is  to  be  under-  gg 
stood  that  the  above  description  is  intended  to  be  illustrative, 
and  not  restrictive.  Many  other  embodiments  will  be  apparent 
to  those  of  skill  in  the  art  upon  reading  and  understanding  the 
above  description.  The  scope  of  the  invention  should,  there¬ 
fore,  be  determined  with  reference  to  the  appended  claims,  65 
along  with  the  full  scope  of  equivalents  to  which  such  claims 
are  entitled. 
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What  is  claimed  is: 

1.  A  method  comprising: 

receiving  a  plurality  of  packets  of  one  or  more  files  at  a 
networked  device  comprising  a  plurality  of  processing 
cores,  the  packets  from  a  plurality  of  connections; 

processing  each  of  the  received  packets,  wherein  process¬ 
ing  each  received  packet  comprises: 
determining  from  which  of  the  plurality  of  connections 
the  packet  came,  and 

postponing  processing  one  of  the  received  packets  based 
on  a  determination  that  another  processing  core  is 
currently  processing  a  packet  from  a  same  connec¬ 
tion,  and 

continuing  to  process  the  one  of  the  received  packets 
based  on  a  determination  that  no  other  processing 
core  is  currently  processing  a  packet  from  the  same 
connection; 

storing  a  current  state  of  pattern  matching  in  a  database  in 
memory  accessible  to  each  of  the  plurality  of  processing 
cores,  wherein  the  current  state  of  pattern  matching  cor¬ 
responds  to  packets  received  from  the  determined  cor¬ 
responding  connection,  and  wherein  a  plurality  of  other 
current  states  of  pattern  matching  are  stored  for  other 
coimections  from  the  plurality  of  connections; 

scanning  each  of  the  plurality  of  packets  using  one  of  the 
plurality  of  processing  cores  in  the  networked  device 
without  buffering  the  one  or  more  files  in  the  networked 
device,  such  that  the  plurality  of  processing  cores  scan 
the  plurality  of  packets  substantially  concurrently, 
wherein  when  the  plurality  of  packets  are  from  one  of  the 
plurality  of  connections,  a  first  processing  core  of  the 
plurality  of  processing  core  receives  an  in-order  packet 
and  scans  the  in-order  packet,  a  second  processing  core 
of  the  plurality  of  processing  core  receives  an  out-of- 
order  packet  and  temporarily  buffers  the  out-of-order 
packet  in  an  out-of-order  buffer  without  scanning  the 
out-of-order  packet,  wherein  the  first  processing  core 
retrieves  a  next  in  order  packet  from  the  out-of-order 
buffer  to  scan  after  scanning  the  in-order  packet;  and 

updating  the  current  state  of  pattern  matching  based  on  a 
plurality  of  scan  results  from  the  plurality  of  processing 
cores,  the  updated  current  state  of  pattern  matching 
stored  with  the  determined  corresponding  connection. 

2.  The  method  of  claim  1,  further  comprising:  resolving 
conflicts  between  out-of-order  packets  among  the  plurality  of 
packets. 

3.  The  method  of  claim  2,  wherein  when  the  plurality  of 
packets  are  from  distinct  ones  of  the  plurality  of  connections, 
the  first  processing  core  of  the  plurality  of  processing  cores 
receives  a  first  packet  from  a  first  connection,  and  resolving 
conflicts  between  out-of-order  packets  further  comprises: 

the  first  processing  core  determining  if  the  first  packet  is 
in-order  or  out-of  order; 

the  first  processing  core  scanning  the  packet  if  the  first 
packet  is  in-order;  and 

the  first  processing  core  temporarily  buffering  the  first 
packet  in  an  out-of  order  buffer  associated  with  the  first 
connection  without  scanning  the  first  packet  if  the  first 
packet  is  out-of-order. 

4.  The  method  of  claim  3,  wherein  resolving  conflicts 
between  out-of-order  packets  further  comprises: 

the  second  processing  core  of  the  plurality  of  processing 
cores  receiving  a  second  packet  from  the  first  connection 
while  the  first  processing  core  is  still  processing  the  first 
packet;  and 

the  second  processing  core  re-scheduling  scanning  of  the 
second  packet  to  a  later  time. 
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5.  The  method  of  claim  1,  wherein  storing  the  current  state 
of  pattern  matching  further  comprises  storing  a  plurality  of 
current  states  in  the  database,  each  current  state  associated 
with  one  of  the  plurality  of  connections. 

6.  An  apparatus  comprising:  5 

a  network  interface  to  receive  a  plurality  of  packets  of  one 

or  more  files  from  a  plurality  of  connections; 

a  plurality  of  processing  cores  to  perform  reassembly-free 
deep  packet  inspection  on  the  plurality  of  packets  with¬ 
out  buffering  the  one  or  more  files  such  that  the  plurality  to 
of  processing  cores  scan  the  plurality  ofpackets  substan¬ 
tially  concurrently,  wherein  each  processing  core  pro¬ 
cesses  each  received  packet  by: 

determining  from  which  of  the  plurality  of  connections 
the  packet  came,  15 

postponing  processing  one  of  the  received  packets  based 
on  a  determination  that  another  processing  core  is 
currently  processing  a  packet  from  a  same  coimec- 
tion,  and 

continuing  to  process  the  one  of  the  received  packets  20 
based  on  a  determination  that  no  other  processing 
core  is  currently  processing  a  packet  from  the  same 
connection,  wherein  when  the  plurality  of  packets  are 
from  one  of  the  plurality  of  connections,  a  first  pro¬ 
cessing  core  of  the  plurality  of  processing  core  25 
receives  an  in-order  packet  and  scans  the  in-order 
packet,  a  second  processing  core  of  the  plurality  of 
processing  core  receives  an  out-of-order  packet  and 
temporarily  buffers  the  out-of-order  packet  in  an  out- 
of-order  buffer  without  scanning  the  out-of-order  30 
packet,  wherein  the  first  processing  core  retrieves  a 
next  in  order  packet  from  the  out-of-order  buffer  to 
scan  after  scanning  the  in-order  packet;  and 

memory  accessible  to  each  of  the  plurality  of  processing 
cores,  the  memory  associated  with  a  database  for  storing  35 
a  current  state  of  pattern  matching,  the  current  state  of 
pattern  matching  corresponding  to  packets  from  the 
determined  corresponding  connection,  wherein  a  plural¬ 
ity  of  other  current  states  of  pattern  matching  are  stored 
for  other  connections  from  the  plurality  of  connections,  40 
wherein  the  current  state  of  pattern  matching  is  updated 
based  on  a  plurality  of  scan  results  from  the  plurality  of 
processing  cores,  the  updated  current  state  of  pattern 
matching  stored  with  the  determined  corresponding 
connection.  45 

7.  The  apparatus  of  claim  6,  wherein  the  plurality  of  pro¬ 
cessing  cores  resolve  conflicts  between  out-of-order  packets 
among  the  plurality  of  packets. 

8.  The  apparatus  of  claim  6,  wherein  when  the  plurality  of 
packets  are  from  distinct  ones  of  the  plurality  of  connections,  50 
the  first  processing  core  of  the  plurality  of  processing  cores 
receives  a  first  packet  from  a  first  connection  and  scans  the 
packet  if  the  first  packet  is  in-order,  and  temporarily  buffers 
the  first  packet  in  an  out-of-order  buffer  associated  with  the 
first  connection  without  scanning  the  first  packet  if  the  first  55 
packet  is  out-of-order. 

9.  The  apparatus  of  claim  6,  wherein  the  second  processing 
core  to  receive  a  second  packet  from  a  first  connection  while 
the  first  processing  core  is  still  processing  the  first  packet,  and 

to  re-schedule  scanning  of  the  second  packet  to  a  later  time.  60 

10.  The  apparatus  of  claim  6,  wherein  the  database  further 
stores  a  plurality  of  current  states,  each  current  state  associ¬ 
ated  with  one  of  the  plurality  of  connections. 

11.  A  system  comprising  the  apparatus  of  claim  6,  further 
comprising:  one  or  more  client  devices  coupled  to  receive  the  65 
plurality  of  packets  after  the  plurality  of  packets  have  been 
scanned  without  identifying  any  prohibited  content. 
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12. A  non-transitory  computer-readable  medium  embody¬ 
ing  instructions  that,  when  executed  by  a  processor,  will  cause 
the  processor  to  perform  operations  comprising: 

receiving  a  plurality  of  packets  of  one  or  more  files  at  a 
networked  device  comprising  a  plurality  of  processing 
cores,  the  packets  from  plurality  of  connections; 

processing  each  of  the  received  packets,  wherein  process¬ 
ing  each  received  packet  comprises: 
determining  from  which  of  the  plurality  of  connections 
the  packet  came, 

postponing  processing  one  of  the  received  packets  based 
on  a  determination  that  another  processing  core  is 
currently  processing  a  packet  from  a  same  connec¬ 
tion,  and 

continuing  to  process  the  one  of  the  received  packets 
based  on  a  determination  that  no  other  processing 
core  is  currently  processing  a  packet  from  the  same 
connection; 

storing  a  current  state  of  pattern  matching  in  a  database 
accessible  to  each  of  the  plurality  of  processing  cores, 
wherein  the  current  state  of  pattern  matching  corre¬ 
sponds  to  packets  from  the  determined  corresponding 
coimection,  and  wherein  a  plurality  of  other  current 
states  of  pattern  matching  are  stored  for  other  connec¬ 
tions  from  the  plurality  of  connections; 

scanning  each  of  the  plurality  of  packets  using  one  of  the 
plurality  of  processing  cores  in  the  networked  device 
without  buffering  the  one  or  more  files  in  the  networked 
device,  such  that  the  plurality  of  processing  cores  scan 
the  plurality  of  packets  substantially  concurrently, 
wherein  when  the  plurality  of  packets  are  from  one  of  the 
plurality  of  connections,  a  first  processing  core  of  the 
plurality  of  processing  core  receives  an  in-order  packet 
and  scans  the  in-order  packet,  a  second  processing  core 
of  the  plurality  of  processing  core  receives  an  out-of- 
order  packet  and  temporarily  buffers  the  out-of-order 
packet  in  an  out-of-order  buffer  without  scanning  the 
out-of-order  packet,  wherein  the  first  processing  core 
retrieves  a  next  in  order  packet  from  the  out-of-order 
buffer  to  scan  after  scanning  the  in-order  packet;  and 

updating  the  current  state  of  pattern  matching  based  on  a 
plurality  of  scan  results  from  the  plurality  of  processing 
cores,  the  updated  current  state  of  pattern  matching 
stored  with  the  determined  corresponding  coimection. 

13.  The  non-transitory  computer-readable  medium  of 
claim  12,  wherein  the  operations  further  comprise:  resolving 
conflicts  between  out-of-order  packets  among  the  plurality  of 
packets. 

14.  The  non-transitory  computer-readable  medium  of 
claim  12,  wherein  when  the  plurality  of  packets  are  from 
distinct  ones  of  the  plurality  of  connections,  the  first  process¬ 
ing  core  of  the  plurality  of  processing  cores  receives  a  first 
packet  from  a  first  connection,  and  resolving  conflicts 
between  out-of-order  packets  further  comprises: 

the  first  processing  core  determining  if  the  first  packet  is 
in-order  or  out-of  order; 

the  first  processing  core  scanning  the  packet  if  the  first 
packet  is  in-order;  and 

the  first  processing  core  temporarily  buffering  the  first 
packet  in  an  out-of  order  buffer  associated  with  the  first 
connection  without  scanning  the  first  packet  if  the  first 
packet  is  out-of-order. 

15.  The  non-transitory  computer-readable  medium  of 
claim  14,  wherein  resolving  conflicts  between  out-of-order 
packets  further  comprises: 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1142  of  1298 


US  8,813,221  B1 

13 

the  second  processing  core  of  the  plurality  of  processing 
cores  receiving  a  second  packet  from  the  first  connection 
while  the  first  processing  core  is  still  processing  the  first 
packet;  and 

the  second  processing  core  re-scheduling  scanning  of  the  5 
second  packet  to  a  later  time. 

16.  The  non-transitory  computer-readable  medium  of 
claim  12,  wherein  storing  the  current  state  of  pattern  match¬ 
ing  further  comprises:  storing  a  plurality  of  current  states  in 
the  database,  each  current  state  associated  with  one  of  the  to 
plurality  of  connections. 


14 
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PATENT  NO.  :  8,813,221  B1  Page  1  of  3 

APPLICATION  NO.  :  12/238205 
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It  is  certified  that  error  appears  in  the  above-identified  patent  and  that  said  Letters  Patent  is  hereby  corrected  as  shown  below: 

In  the  Claims 

Column  10,  Lines  44-46  should  read: 

2.  The  method  of  claim  1,  further  comprising[[:]]  resolving  conflicts  between  out-of-order  packets 
among  the  plurality  of  packets. 

Column  10,  Lines  47-59  should  read: 

3.  The  method  of  claim  2,  wherein  when  the  plurality  of  packets  are  from  distinct  ones  of  the 
plurality  of  connections,  the  first  processing  core  of  the  plurality  of  processing  cores  receives  a  first 
packet  from  a  first  connection,  and  resolving  conflicts  between  out-of-order  packets  further  comprises: 

the  first  processing  core  determining  if  the  first  packet  is  in-order;  and 
the  first  processing  core  scanning  the  packet  if  the  first  packet  is  in-order 

Column  11,  Lines  49-56  should  read: 

8.  The  apparatus  of  claim  6,  wherein  when  the  plurality  of  packets  are  from  distinct  ones  of  the 
plurality  of  connections,  the  first  processing  core  of  the  plurality  of  processing  cores  receives  a  first 
packet  from  a  first  connection  and  scans  the  packet  if  the  first  packet  is  in-order 

Column  11,  Lines  64-67  should  read: 

11.  A  system  comprising  the  apparatus  of  claim  6,  further  comprising  [[:]]  one  or  more  client  devices 
coupled  to  receive  the  plurality  of  packets  after  the  plurality  of  packets  have  been  scanned  without 
identifying  any  prohibited  content. 

Column  12,  Lines  47-50  should  read: 
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13.  The  non-transitory  computer-readable  medium  of  claim  12,  wherein 

the  operations  further  comprise  [[:]]  resolving  conflicts  between  out-of-order  packets  among  the 
plurality  of  packets. 

Column  12,  Lines  51-64  should  read: 

14.  The  non-transitory  computer-readable  medium  of  claim  [[12]]  13,  wherein 

when  the  plurality  of  packets  are  from  distinct  ones  of  the  plurality  of  cormections,  the  first 
processing  core  of  the  plurality  of  processing  cores  receives  a  first  packet  from  a  first  cormection, 
and  resolving  conflicts  between  out-of-order  packets  further  comprises: 

the  first  processing  core  determining  if  the  first  packet  is  in-order;  and 
the  first  processing  core  scanning  the  packet  if  the  first  packet  is  in-order 

Column  13,  Lines  7-1 1  should  read: 

16.  The  non-transitory  computer-readable  medium  of  claim  12,  wherein  storing  the  current  state 
of  pattern  matching  further  comprises  [[:]]  storing  a  plurality  of  current  states  in  the  database,  each 
current  state  associated  with  one  of  the  plurality  of  connections. 

Column  13,  Lines  12-19  should  read: 

17.  The  method  of  claim  2,  wherein  when  the  plurality  of  packets  are  from  distinct  ones  of  the 
plurality  of  cormections,  the  first  processing  core  of  the  plurality  of  processing  cores  receives  a  first 
packet  from  a  first  cormection,  and  resolving  conflicts  between  out-of-order  packets  further  comprises: 

the  first  processing  core  determining  if  the  first  packet  is  out-of-order;  and 
the  first  processing  core  temporarily  buffering  the  first  packet  in  an  out-of-order 
buffer  associated  with  the  first  cormection  without  scanning  the  first  packet  if  the  first  packet  is 
out-of-order. 

Column  13,  Lines  20-24  should  read: 

18.  The  apparatus  of  claim  6,  wherein  when  the  plurality  of  packets  are  from  distinct  ones  of  the 
plurality  of  cormections,  the  first  processing  core  of  the  plurality  of  processing  cores  receives  a  first 
packet  from  a  first  cormection  and  temporarily  buffers  the  first  packet  in  an  out-of-order  buffer 
associated  with  the  first  cormection  without  scanning  the  first  packet  if  the  first  packet  is  out-of-order. 


Column  13,  Lines  25-32  should  read: 

1 9.  The  non-transitory  computer-readable  medium  of  claim  1 3,  wherein  when  the  plurality  of  packets 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1145  of  1298 

CERTIFICATE  OF  CORRECTION  (continued)  Page  3  of  3 

U.S.  Pat.  No.  8,813,221  B1 

are  from  distinct  ones  of  the  plurality  of  connections,  the  first  processing  core  of  the  plurality  of 
processing  cores  receives  a  first  packet  from  a  first  connection,  and  resolving  conflicts  between  out-of- 
order  packets  further  comprises: 

the  first  processing  core  determining  if  the  first  packet  is  out-of  order;  and 
the  first  processing  core  temporarily  buffering  the  first  packet  in  an  out-of  order  buffer 
associated  with  the  first  connection  without  scanning  the  first  packet  if  the  first  packet  is  out-of-order. 
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Release  No:  PA-014-18 
April  28,  2017 

Since  2008,  the  National  Security  Agency  (NSA)  and  other  members  of  the  U.S. 

Intelligence  Community  have  relied  on  Section  702  of  the  Foreign  Intelligence 
Surveillance  Act  (FISA)  to  conduct  surveillance  on  specific  foreign  targets  located 
outside  the  United  States  to  acquire  critical  intelligence  on  issues  ranging  from 
international  terrorism  to  cybersecurity.  After  a  comprehensive  review  of  mission 
needs,  current  technological  constraints.  United  States  person  privacy  interests,  and 
certain  difficulties  in  implementation,  NSA  has  decided  to  stop  some  of  its  activities 
conducted  under  Section  702. 

While  the  Foreign  Intelligence  Surveillance  Court  (FISC)  was  considering  the 
government's  annual  application  to  renew  the  Section  702  certifications,  NSA 
reported  several  earlier,  inadvertent  compliance  incidents  related  to  queries  involving 
U.S.  person  information  in  702  "upstream"  internet  collection.  Although  the  incidents 
were  not  willful,  NSA  was  required  to,  and  did,  report  them  to  both  Congress  and  the 
FISC.  The  court  issued  two  extensions  of  the  government's  renewal  application  in 
order  to  receive  additional  information  from  the  government  about  this  issue  and  the 
government's  plan  to  resolve  it.  The  previous  year's  certifications  remained  in  effect 
during  these  extension  periods. 

During  the  extension  period,  NSA  undertook  a  broad  review  of  its  Section  702 
program.  Under  Section  702,  NSA  collects  internet  communications  in  two  ways: 

"downstream"  (previously  referred  to  as  PRISM)  and  "upstream."  Under  downstream 
collection,  NSA  acquires  communications  "to  or  from"  a  Section  702  selector  (such  as 
an  email  address).  Under  upstream  collection,  NSA  acquires  communications  "to, 
from,  or  about"  a  Section  702  selector.  An  example  of  an  "about"  email 
communication  is  one  that  includes  the  targeted  email  address  in  the  text  or  body  of 
the  email,  even  though  the  email  is  between  two  persons  who  are  not  themselves 
targets.  The  independent  Privacy  and  Civil  Liberties  Oversight  Board  described  these 
collection  methods  in  an  exhaustive  report  published  in  2014. 

After  considerable  evaluation  of  the  program  and  available  technology,  NSA  has 
decided  that  its  Section  702  foreign  intelligence  surveillance  activities  will  no  longer 
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intelligence  target.  Instead,  this  surveillance  will  now  be  limited  to  only  those 
communications  that  are  directly  "to"  or  "from"  a  foreign  intelligence  target.  These 
changes  are  designed  to  retain  the  upstream  collection  that  provides  the  greatest 
value  to  national  security  while  reducing  the  likelihood  that  NSA  will  acquire 
communications  of  U.S.  persons  or  others  who  are  not  in  direct  contact  with  one  of 
the  Agency's  foreign  intelligence  targets. 

In  addition,  as  part  of  this  curtailment,  NSA  will  delete  the  vast  majority  of  previously 
acquired  upstream  internet  communications  as  soon  as  practicable. 

NSA  previously  reported  that,  because  of  the  limits  of  its  current  technology,  it  is 
unable  to  completely  eliminate  "about"  communications  from  its  upstream  702 
collection  without  also  excluding  some  of  the  relevant  communications  directly  "to  or 
from"  its  foreign  intelligence  targets.  That  limitation  remains  even  today.  Nonetheless, 

NSA  has  determined  that  in  light  of  the  factors  noted,  this  change  is  a  responsible 
and  careful  approach  at  this  time. 

After  reviewing  amended  Section  702  certifications  and  NSA  procedures  that 
implement  these  changes,  the  FISC  recently  issued  an  opinion  and  order,  approving 
the  renewal  certifications  and  use  of  procedures,  which  authorize  this  narrowed  form 
of  Section  702  upstream  internet  collection.  A  declassification  review  of  the  RISC's 
opinion  and  order,  and  the  related  targeting  and  minimization  procedures,  is 
underway. 

The  National  Security  Agency  works  tirelessly  around  the  world  to  help  keep  the 
nation  safe.  We  have  a  solemn  responsibility  and  commitment  to  do  this  work  exactly 
right.  When  incidents  occur,  we  immediately  report  them  to  oversight  bodies  and 
develop  appropriate  solutions.  We  never  stop  putting  improvements  in  place  while 
carrying  out  our  critical  mission. 
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The  National  Security  Agency  is  instituting  several  changes  in  the  way  it  collects 
information  under  Section  702  of  the  Foreign  Intelligence  Surveillance  Act. 

Section  702,  set  to  expire  at  the  end  of  this  year,  allows  the  Intelligence  Community  to 
conduct  surveillance  on  only  specific  foreign  targets  located  outside  the  United  States 
to  collect  foreign  intelligence,  including  intelligence  needed  in  the  fight  against 
international  terrorism  and  cyber  threats. 

NSA  will  no  longer  collect  certain  internet  communications  that  merely  mention  a 
foreign  intelligence  target.  This  information  is  referred  to  in  the  Intelligence 
Community  as  "about"  communications  in  Section  702  "upstream"  internet 
surveillance.  Instead,  NSA  will  limit  such  collection  to  internet  communications  that 
are  sent  directly  to  or  from  a  foreign  target. 

Even  though  NSA  does  not  have  the  ability  at  this  time  to  stop  collecting  "about" 
information  without  losing  some  other  important  data,  the  Agency  will  stop  the 
practice  to  reduce  the  chance  that  it  would  acquire  communications  of  U.S.  persons 
or  others  who  are  not  in  direct  contact  with  a  foreign  intelligence  target. 

Finally,  even  though  the  Agency  was  legally  allowed  to  retain  such  "about"  information 
previously  collected  under  Section  702,  the  NSA  will  delete  the  vast  majority  of  its 
upstream  internet  data  to  further  protect  the  privacy  of  U.S.  person  communications. 

The  changes  in  policy  followed  an  in-house  review  of  Section  702  activities  in  which 
NSA  discovered  several  inadvertent  compliance  lapses. 

NSA  self-reported  the  incidents  to  both  Congress  and  the  FISC,  as  it  is  required  to 
do.  Following  these  reports,  the  FISC  issued  two  extensions  as  NSA  worked  to  fix  the 
problems  before  the  government  submitted  a  new  application  for  continued  Section 
702  certification.  The  FISC  recently  approved  the  changes  after  an  extensive  review. 

The  Agency's  efforts  are  part  of  its  commitment  to  continuous  improvement  as  we 
work  to  keep  the  nation  safe.  NSA  has  a  solemn  responsibility  and  duty  to  do  our 
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Introduction 


Today,  consistent  with  the  USA  FREEDOM  Act  and  the  FISA  Amendments  Reauthorization  Act  of 
2017  (the  reauthorized  FAA)  requirements  to  release  certain  statistics  (codified  in  50  U.S.C. 

§  1873(b))  and  the  Intelligence  Community's  (1C)  Principles  of  Intelligence  Transparency,  we  are 
releasing  our  fifth  annual  Statistical  Transparency  Report  Regarding  Use  of  National  Security 
Authorities  presenting  statistics  on  how  often  the  government  uses  certain  national  security 
authorities.  Providing  these  statistics  allows  for  an  additional  way  to  track  the  use  of  Foreign 
Intelligence  Surveillance  Act  (FISA)  authorities  and  gives  further  context  to  the  IC's  rigorous  and 
multi-layered  oversight  framework  that  safeguards  the  privacy  of  United  States  person 
information  acquired  pursuant  to  FISA.  The  report  goes  beyond  its  statutory  duty  of  providing 
statistics  and  further  provides  the  public  with  detailed  explanation  as  to  how  the  1C  uses  these 
national  security  authorities. 

Additional  public  information  on  national  security  authorities  is  available  at  the  Office  of  the 
Director  of  National  Intelligence's  (ODNI)  website,  www.dni.gov,  and  ODNI's  public  tumbir  site, 
1C  on  the  Record.  Furthermore,  since  the  release  of  the  previous  report,  ODNI  has  created  the 
new  website,  www.intelligence.gov,  that  contains  additional  public  information  on  the  IC's 
activities. 

A.  Background. 

In  June  2014,  the  Director  of  National  Intelligence  (DNI)  began  releasing  statistics  relating  to  the 
use  of  critical  national  security  authorities,  including  the  FISA,  in  an  annual  report  called  the 
Statistical  Transparency  Report  Regarding  Use  of  National  Security  Authorities  (hereafter  the 
Annual  Statistical  Transparency  Report).  Subsequent  Annual  Statistical  Transparency  Reports 
were  released  in  2015,  2016,  and  2017. 

On  June  2,  2015,  the  USA  FREEDOM  Act  was  enacted,  codifying  a  requirement  to  publicly  report 
many  of  the  statistics  already  reported  in  the  Annual  Statistical  Transparency  Report.  The  Act 
also  expanded  the  scope  of  the  information  included  in  the  reports  by  requiring  the  DNI  to 
report  information  concerning  United  States  person  (U.S.  person  or  USP)  search  terms  and 
queries  of  certain  FISA-acquired  information,  as  well  as  specific  statistics  concerning  call  detail 
records.  See  50  U.S.C.  §  1873(b).  On  January  19,  2018,  the  reauthorized  FAA  was  signed.  See  50 
U.S.C.  §  1881a.  The  reauthorized  FAA  (also  referred  to  as  the  Section  702  Reauthorization  Act  of 
2017)  codified  additional  statistics  that  must  be  publicly  released,  including  many  statistics  that 
the  government  previously  reported  pursuant  to  its  commitment  to  transparency. 


3  I  P  a  g  e 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1155  of  1298 


B.  Areas  Covered  in  this  Report. 

This  report  provides  statistics  in  the  following  areas  (the  terms  used  below  are  defined  and 
explained  later  in  this  report): 

•  FISA  Probable  Cause  Authorities.  The  number  of  orders— and  the  number  of  targets 
under  those  orders— for  the  use  of  FISA  authorities  that  require  probable  cause 
determinations  by  the  Foreign  Intelligence  Surveillance  Court  (FISC),  under  Titles  I  and 
III,  and  Section  703  and  704,  of  FISA. 

•  FISA  Section  702. 

o  The  number  of  orders— and  the  number  of  targets  under  those  orders— issued 
pursuant  to  Section  702  of  FISA. 

o  The  number  of  U.S.  person  queries  of  Section  702-acquired  content  and  metadata, 
o  The  number  of  instances  in  which  the  Federal  Bureau  of  Investigation  (FBI) 
personnel  received  and  reviewed  Section  702-acquired  information  that  the  FBI 
identified  as  concerning  a  U.S.  person  in  response  to  a  query  that  was  designed  to 
return  evidence  of  a  crime  unrelated  to  foreign  intelligence, 
o  The  number  of  instances  in  which  the  FBI  opened,  under  the  Criminal  Investigative 
Division,  an  investigation  of  a  U.S.  person  (who  is  not  considered  a  threat  to  national 
security)  based  wholly  or  in  part  on  Section  702-acquired  information, 
o  The  number  of  National  Security  Agency  (NSA)-disseminated  Section  702  reports 
containing  U.S.  person  identities  (various  statistics  relating  to  reports  where  the  U.S. 
person  identity  was  openly  named  or  originally  masked  and  subsequently 
unmasked). 

•  Use  in  Criminal  Proceedings.  The  number  of  criminal  proceedings  in  which  the  United 
States  or  a  State  or  political  subdivision  provided  notice  under  FISA  of  the  government's 
intent  to  enter  into  evidence  or  otherwise  use  or  disclose  any  information  derived  from 
electronic  surveillance,  physical  search,  or  Section  702  acquisition. 

•  Pen  Register  and  Trap  and  Trace  Devices.  The  number  of  orders— and  the  number  of 
targets  under  those  orders— for  the  use  of  FISA's  pen  register/trap  and  trace  devices, 
and  the  number  of  unique  identifiers  used  to  communicate  information  collected 
pursuant  to  those  orders. 

•  Business  Records.  The  number  of  orders— and  the  number  of  targets  under  those 
orders— issued  pursuant  to  FISA's  business  records  authority,  and  the  number  of  unique 
identifiers  used  to  communicate  information  collected  pursuant  to  those  orders.  In 
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addition,  the  number  of  orders— and  the  number  of  targets  under  those  orders— issued 
pursuant  to  FISA's  business  record  authority  for  the  production  of  call  detail  records, 
and  the  number  of  call  detail  records  received  from  providers  and  stored  in  NSA 
repositories. 

•  National  Security  Letters.  The  number  of  national  security  letters  issued,  and  the 
number  of  requests  for  information  within  those  national  security  letters. 

C.  Context  and  Clarity. 

Consistent  with  the  IC's  Principles  of  Intelligence  Transparency,  this  report  seeks  to  enhance 
public  understanding  by  including  explanations  and  charts  for  context  and  clarity.  For  example, 
the  report  provides  charts  that  place  the  statistics  in  this  report  in  context  with  the  statistics  in 
prior  reports.  While  these  statistics  provide  an  important  point  of  reference  for  understanding 
the  use  of  these  authorities,  it  is  important  to  keep  in  mind  the  statistics'  limitations.  The 
statistics  fluctuate  from  year  to  year  for  a  variety  of  reasons  (e.g.,  operational  priorities,  world 
events,  technical  capabilities),  some  of  which  cannot  be  explored  in  an  unclassified  setting. 
Moreover,  there  may  be  no  relationship  between  a  decrease  in  the  use  of  one  authority  and  an 
increase  in  another.  Nonetheless,  we  believe  this  report  provides  helpful  information  about 
how  the  1C  uses  these  vital  national  security  authorities. 

D.  Key  Terms. 

Certain  terms  used  throughout  this  report  are  described  below.  Other  terms  are  described  in 
the  sections  in  which  they  are  most  directly  relevant. 

•  U.S.  Person.  As  defined  by  Title  I  of  FISA,  a  U.S.  person  is  "a  citizen  of  the  United 
States ,  an  alien  lawfully  admitted  for  permanent  residence  (as  defined  in  section 
101(a)(20)  of  the  Immigration  and  Nationality  Act),  an  unincorporated  association  a 
substantial  number  of  members  of  which  are  citizens  of  the  United  States  or  aliens 
lawfully  admitted  for  permanent  residence,  or  a  corporation  which  is  incorporated 
in  the  United  States,  but  does  not  include  a  corporation  or  an  association  which  is  a 
foreign  power,  as  defined  in  [50  U.S.C.  §  1801(a)(1),  (2),  or  (3)]."  50  U.S.C.  §  1801(i). 
Section  602  of  the  USA  FREEDOM  Act,  however,  uses  a  narrower  definition.  Since 
the  broader  Title  I  definition  governs  how  U.S.  person  queries  are  conducted 
pursuant  to  the  relevant  minimization  procedures,  it  will  be  used  throughout  this 
report. 
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•  Target.  Within  the  1C,  the  term  "target"  has  multiple  meanings.  With  respect  to  the 
statistics  provided  in  this  report,  the  term  "target"  is  defined  as  the  individual 
person,  group,  entity  composed  of  multiple  individuals,  or  foreign  power  that  uses 
the  selector  such  as  a  telephone  number  or  email  address. 

•  Orders.  There  are  different  types  of  orders  that  the  FISC  may  issue  in  connection 
with  FISA  cases,  for  example:  orders  granting  or  modifying  the  government's 
authority  to  conduct  foreign  intelligence  collection;  orders  directing  electronic 
communication  service  providers  to  provide  any  technical  assistance  necessary  to 
implement  the  authorized  foreign  intelligence  collection;  and  supplemental  orders 
and  briefing  orders  requiring  the  government  to  take  a  particular  action  or  provide 
the  court  with  specific  information.  The  FISC  may  amend  an  order  one  or  more  times 
after  it  has  been  issued.  For  example,  an  order  may  be  amended  to  add  a  newly 
discovered  account  used  by  the  target.  This  report  does  not  count  such  amendments 
separately.  The  FISC  may  renew  some  orders  multiple  times  during  the  calendar 
year.  Each  authority  permitted  under  FISA  has  specific  time  limits  for  the  FISA 
authority  to  continue  (e.g.,  a  Section  704  order  against  a  U.S.  person  target  outside 
of  the  United  States  may  last  no  longer  than  90  days  but  FISA  permits  the  order  to 
be  renewed,  see  50  U.S.C.  §  1881c(c)(4)).  Each  renewal  requires  a  separate 
application  submitted  by  the  government  to  the  FISC  and  a  finding  by  the  FISC  that 
the  application  meets  the  requirements  of  FISA.  Thus,  unlike  amendments,  this 
report  does  count  each  such  renewal  as  a  separate  order.  These  terms  will  be  used 
consistently  throughout  this  report. 

•  "Estimated  Number."  Throughout  this  report,  when  numbers  are  estimated,  the 
estimate  comports  with  the  statutory  requirements  to  provide  a  "good  faith 
estimate"  of  a  particular  number. 

•  Dissemination.  In  the  most  basic  sense,  dissemination  refers  to  the  sharing  of 
minimized  information.  As  it  pertains  to  FISA  (including  Section  702),  if  an  agency  (in 
this  instance  NSA)  lawfully  collects  information  pursuant  to  FISA  and  wants  to 
disseminate  that  information,  the  agency  must  first  apply  its  minimization 
procedures  to  that  information. 
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FISA  Probable  Cause  Authorities 


A.  FISA  Titles  I  and  III 

To  conduct  electronic  surveillance  or 
physical  search  under  FISA  Title  I  or  FISA 
Title  III,  a  probable  cause  court  order  is 
required  regardless  of  U.S.  person  status. 

Under  FISA,  Title  I  permits  electronic 
surveillance  and  Title  III  permits  physical 
search  in  the  United  States  of  foreign 
powers  or  agents  of  a  foreign  power  for 
the  purpose  of  collecting  foreign 
intelligence  information.  See  50  U.S.C. 

§§  1804  and  1823.  Title  I  (electronic 
surveillance)  and  Title  III  (physical  search) 
are  commonly  referred  to  as  "Traditional  FISA."  Both  require  that  the  FISC  make  a  probable 
cause  finding,  based  upon  a  factual  statement  in  the  government's  application,  that  (i)  the 
target  is  a  foreign  power  or  an  agent  of  a  foreign  power,  as  defined  by  FISA  and  (ii)  the  facility 
being  targeted  for  electronic  surveillance  is  used  by  or  about  to  be  used,  or  the  premises  or 
property  to  be  searched  is  or  is  about  to  be  owned,  used,  possessed  by,  or  is  in  transit  to  or 
from  a  foreign  power  or  an  agent  of  a  foreign  power.  In  addition  to  meeting  the  probable  cause 
standard,  the  government's  application  must  meet  the  other  requirements  of  FISA.  See  50 
U.S.C.  §§  1804(a)  and  1823(a). 

B.  FISA  Title  VII,  Sections  703  and  704 

FISA  Title  VII  Sections  703  and  704  similarly  require  a  court  order  based  on  a  finding  of 
probable  cause  for  the  government  to  undertake  FISA  activities  targeting  U.S.  persons  located 
outside  the  United  States.  Section  703  applies  when  the  government  seeks  to  conduct 
electronic  surveillance  or  to  acquire  stored  electronic  communications  or  stored  electronic 
data,  in  a  manner  that  otherwise  requires  an  order  pursuant  to  FISA,  of  a  U.S.  person  who  is 
reasonably  believed  to  be  located  outside  the  United  States.  Section  704  applies  when  the 
government  seeks  to  conduct  collection  overseas  targeting  a  U.S.  person  reasonably  believed  to 
be  located  outside  the  United  States  under  circumstances  in  which  the  U.S.  person  has  a 
reasonable  expectation  of  privacy  and  a  warrant  would  be  required  if  the  acquisition  were 
conducted  in  the  United  States.  Both  Sections  703  and  704  require  that  the  FISC  make  a 


FISA  Title  I,  Title  III,  and 
Title  VII  Section  703  and  704 

-^All  of  these  authorities  require  individual  court  orders 
based  on  probable  cause. 

Titles  I  and  III  apply  to  FISA  activities  directed  against 
persons  within  the  United  States. 

Sections  703  and  704  apply  to  FISA  activities  directed 
against  U.S.  persons  outside  the  United  States. 
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probable  cause  finding,  based  upon  a  factual  statement  in  the  government's  application,  that 
the  target  is  a  U.S.  person  reasonably  believed  to  be  (i)  located  outside  the  United  States  and 
(ii)  a  foreign  power,  agent  of  a  foreign  power,  or  officer  or  employee  of  a  foreign  power. 
Additionally,  the  government's  application  must  meet  the  other  requirements  of  FISA.  See  50 
U.S.C.  §§  1881b(b)  and  1881c(b). 

C.  Statistics 

How  targets  are  counted.  If  the  1C  received  authorization  to  conduct  electronic  surveillance 
and/or  physical  search  against  the  same  target  in  four  separate  applications,  the  1C  would  count 
one  target,  not  four.  Alternatively,  if  the  1C  received  authorization  to  conduct  electronic 
surveillance  and/or  physical  search  against  four  targets  in  the  same  application,  the  1C  would 
count  four  targets.  Duplicate  targets  across  authorities  are  not  counted. 


Figure  la:  Table  of  FISA  "Probable  Cause"  Court  Orders  and  Targets 


Titles  1  and  III  and  Sections  703  and  704 

of  FISA 

CY2013 

CY2014 

CY2015 

CY2016 

CY2017 

Total  number  of  orders 

1,767 

1,519 

1,585 

1,559 

1,437 

Estimated  number  of  targets  of  such 

orders* 

1,144 

1,562 

1,695 

1,687 

1,337 

5ee  50  U.S.C.  §§  1873(b)(1)  and  1873(b)(1)(A). 

*  Although  providing  this  statistic  was  first  required  by  the  USA  FREEDOM  Act,  the  reauthorized 
FAA  of  2017  enumerated  this  requirement  at  50  U.S.C.  §  1873(b)(1)(A). 
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Figure  lb:  Chart  of  FISA  "Probable  Cause"  Court  Orders  and  Targets 


FISA  "Probable  Cause" 

Court  Orders  and  Total  Targets 
Titles  I  &  III  and  Sections  703  &  704 


CY2013  CY2014  CY2015  CY2016  CY2017 

■  Total  Orders  ■  Est.  Total  Targets 


Figure  2:  Table  of  FISA  "Probable  Cause"  Targets  -  U.S.  Persons 


Titles  1  and  III  and  Sections  703  and  704  -  Targets 

CY2016 

CY2017 

Estimated  number  of  targets  who  are  non-U. S.  persons* 

1,351 

1,038 

Estimated  number  of  targets  who  are  U.S.  persons* 

336 

299 

Estimated  percentage  of  targets  who  are  U.S.  persons 

19.9% 

22.4% 

See  50  U.S.C.  §§1873(b)(l)(B)  and  1873(b)(1)(C)  for  rows  one  and  two,  respectively. 

*  Previously  the  1C  was  not  statutorily  required  to  publicly  provide  these  statistics  but  provided 
them  consistent  with  transparency  principles.  The  reauthorized  FAA  of  2017  codified  this 
requirement  at  50  U.S.C.  §§  1873(b)(1)(B)  and  1873(b)(1)(C). 
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FISA  Section  702 


A.  Section  702 

Title  VII  of  FISA  includes  Section  702, 
which  permits  the  Attorney  General  and 
the  DNI  to  jointly  authorize  the  targeting 
of  (i)  non-U. S.  persons  (ii)  reasonably 
believed  to  be  located  outside  the  United 
States  (iii)  to  acquire  foreign  intelligence 
information.  See  50  U.S.C.  §  1881a.  All 
three  elements  must  be  met. 

Additionally,  Section  702  requires  that 
the  Attorney  General,  in  consultation 
with  the  DNI,  adopt  targeting  procedures, 
minimization  procedures,  and  querying 
procedures  that  they  attest  satisfy  the  statutory  requirements  and  are  consistent  with  the 
Fourth  Amendment.  Additional  information  on  how  the  government  uses  Section  702  is  posted 
on  icon  the  Record. 

Section  702  Targets  and  "Tasking."  Under  Section  702,  the  government  "targets"  a  particular 
non-U. S.  person,  group,  or  entity  reasonably  believed  to  be  located  outside  the  United  States 
and  who  possesses,  or  who  is  likely  to  communicate  or  receive,  foreign  intelligence 
information,  by  directing  an  acquisition  at  -  i.e.,  "fosk/ng"-  selectors  (e.g.,  telephone  numbers 
and  email  addresses)  that  are  assessed  to  be  used  by  such  non-U. S.  person,  group,  or  entity, 
pursuant  to  targeting  procedures  approved  by  the  FISC.  Before  "tasking"  a  selector  for 
collection  under  Section  702,  the  government  must  apply  its  targeting  procedures  to  ensure 
that  the  1C  appropriately  tasks  a  selector  used  by  a  non-U. S.  person  who  is  reasonably  believed 
to  be  located  outside  the  United  States  and  who  will  likely  possess,  communicate,  or  receive 
foreign  intelligence  information. 

NSA  and  FBI  task  selectors  pursuant  to  their  respective  Section  702  targeting  procedures,  which 
are  discussed  below.  All  agencies  that  receive  unminimized  (i.e.,  "raw")  Section  702  data  -  NSA, 
FBI,  Central  Intelligence  Agency  (CIA),  and  National  Counterterrorism  Center  (NCTC)  -  handle 
the  Section  702-acquired  data  in  accordance  with  minimization  procedures,  which  are 
explained  below. 


Title  VII  -  FISA  Amendments  Act  (FAA)  Section  702 

Commonly  referred  to  as  "Section  702." 

Requires  individual  targeting  determinations  that  the 
target  (1)  is  a  non-U. S.  person  (2)  who  is  reasonably 
believed  to  be  located  outside  the  United  States  and  (3) 
who  has  or  is  expected  to  communicate  or  receive  foreign 
intelligence  information. 
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The  RISC's  role.  Under  Section  702,  the  FISC  determines  whether  certifications  provided  jointly 
by  the  Attorney  General  and  the  DNI  meet  all  the  requirements  of  Section  702.  If  the  FISC 
determines  that  the  government's  certifications  its  targeting,  minimization,  and,  as  described 
below,  querying  procedures  meet  the  statutory  requirements  of  Section  702  and  are  consistent 
with  the  Fourth  Amendment,  then  the  FISC  issues  an  order  and  supporting  statement  approving 
the  certifications.  The  2016  FISC  order  and  statement  approving  certifications  was  publicly 
released  in  May  2017  and  posted  on  1C  on  the  Record. 

Certifications.  The  certifications  are  jointly  executed  by  the  Attorney  General  and  DNI  and 
authorize  the  government  to  acquire  foreign  intelligence  information  under  Section  702.  Each 
annual  certification  application  package  must  be  submitted  to  the  FISC  for  approval.  The 
package  includes  the  Attorney  General  and  DNI's  certifications,  affidavits  by  certain  heads  of 
intelligence  agencies,  targeting  procedures,  minimization  procedures,  and,  as  described  below, 
querying  procedures.  Samples  of  certification  application  packages  have  been  publicly  released 
on  1C  on  the  Record,  most  recently  in  May  2017.  The  certifications  identify  categories  of 
information  to  be  collected,  which  must  meet  the  statutory  definition  of  foreign  intelligence 
information,  through  the  targeting  of  non-U. S.  persons  reasonably  believed  to  be  located 
outside  the  United  States.  The  certifications  have  included  information  concerning  international 
terrorism  and  other  topics,  such  as  the  acquisition  of  information  concerning  weapons  of  mass 
destruction. 

Targeting  procedures.  The  targeting  procedures  detail  the  steps  that  the  government  must 
take  before  tasking  a  selector,  as  well  as  verification  steps  after  tasking,  to  ensure  that  the  user 
of  the  tasked  selector  is  being  targeted  appropriately  -  specifically,  that  the  user  is  a  non-U. S. 
person,  located  outside  the  United  States,  who  is  being  tasked  to  acquire  foreign  intelligence 
information.  The  1C  must  make  individual  determinations  that  each  tasked  selector  meets  the 
requirements  of  the  targeting  procedures.  Each  agency's  Section  702  targeting  procedures  are 
approved  by  the  Attorney  General  and  then  reviewed,  as  part  of  the  certification  package,  by 
the  FISC,  which  reviews  the  sufficiency  of  each  agency's  targeting  procedures  including 
assessing  the  IC's  compliance  with  the  procedures.  NSA's  targeting  procedures  (signed  in  2017) 
for  the  2016  certification  package  have  been  publicly  released  1C  on  the  Record. 

Minimization  procedures.  The  minimization  procedures  detail  requirements  the  government 
must  meet  to  use,  retain,  and  disseminate  Section  702  data,  which  include  specific  restrictions 
on  how  the  1C  handles  non-publicly  available  U.S.  person  information  acquired  from  Section 
702  collection  of  non-U. S.  person  targets,  consistent  with  the  needs  of  the  government  to 
obtain,  produce,  and  disseminate  foreign  intelligence  information.  Each  agency's  Section  702 
minimization  procedures  are  approved  by  the  Attorney  General  and  then  reviewed,  as  part  of 
the  certification  package,  by  the  FISC,  which  reviews  the  sufficiency  of  each  agency's 
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minimization  procedures,  including  assessing  the  IC's  compliance  with  past  procedures.  The 
2016  certification  minimization  procedures  have  been  released  on  1C  on  the  Record. 

Querying  procedures.  With  the  reauthorized  FAA  of  2017,  Congress  amended  Section  702  to 
require  that  querying  procedures  be  adopted  by  the  Attorney  General,  in  consultation  with  the 
DNI.  Section  702(f)  requires  that  a  record  of  each  U.S.  person  query  term  be  kept.  Similar  to  the 
other  procedures,  the  querying  procedures  are  required  to  be  reviewed  by  the  FISC  as  part  of 
the  certification  package  for  consistency  with  the  statute  and  the  Fourth  Amendment.  Congress 
added  other  requirements  in  702(f),  which  pertain  to  the  access  of  certain  results  of  queries 
conducted  by  FBI;  those  requirements  will  be  discussed  later  in  this  report. 

To  date,  each  agency's  court-approved  minimization  procedures  have  provided  the  rules  under 
which  the  agency  may  query  their  databases  containing  previously  acquired  Section  702  data 
(content  and  metadata)  using  a  U.S.  person  query  term.  As  described  above,  with  the 
reauthorized  FAA  of  2017,  Congress  amended  Section  702  to  require  that,  going  forward, 
querying  procedures  must  be  adopted  by  the  Attorney  General.  Query  terms  may  be  date- 
bound,  and  may  include  alphanumeric  strings,  such  as  telephone  numbers,  email  addresses,  or 
terms,  such  as  a  name,  that  can  be  used  individually  or  in  combination  with  one  another. 
Pursuant  to  court-approved  procedures,  an  agency  can  only  query  Section  702  information  if 
the  query  is  reasonably  likely  to  return  foreign  intelligence  information  or,  in  the  case  of  the 
FBI,  evidence  of  a  crime.  Additional  information  about  U.S.  person  queries  is  posted  on  1C  on 
the  Record. 

Compliance.  The  IC's  adherence  to  the  targeting  and  minimization  procedures,  including  query 
requirements,  is  subject  to  robust  internal  agency  oversight  and  to  rigorous  external  oversight 
by  the  Department  of  Justice  (DOJ),  ODNI,  Congress,  and  the  FISC  Every  identified  incidence  of 
non-compliance  is  reported  to  the  FISC  (through  individual  notices  or  in  reports)  and  to 
Congress  in  semiannual  reports.  DOJ  and  ODNI  also  submit  semiannual  reports  to  Congress  that 
assess  the  IC's  overall  compliance  efforts.  Past  assessments  have  been  publicly  released. 

B.  Statistics— Orders  and  Targets 

Counting  Section  702  orders.  As  explained  above,  the  FISC  may  issue  a  single  order  to  approve 
more  than  one  Section  702  certification  to  acquire  foreign  intelligence  information.  Note  that, 
in  its  own  transparency  report,  which  is  required  pursuant  to  50  U.S.C.  §  1873(a),  the  Director 
of  the  Administrative  Office  of  the  United  States  Courts  (AOUSC)  counted  each  of  the  Section 
702  certifications  associated  with  the  FISC's  order.  Because  the  number  of  the  government's 
Section  702  certifications  remains  a  classified  fact,  the  government  requested  that  the  AOUSC 
redact  the  number  of  certifications  from  its  transparency  report  prior  to  publicly  releasing  it. 
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In  2016,  the  government  submitted  a  certification  application  package  to  the  FISC.  Pursuant  to 
50  U.S.C.  §  1881a(j)(2),  the  FISC  extended  its  review  of  the  2016  certification  package.  The  FISC 
may  extend  its  review  of  the  certifications  "as  necessary  for  good  cause  in  a  manner  consistent 
with  national  security."  See  50  U.S.C.  §  1881a(j)(2)  (note  that  with  the  reauthorized  FAA  of 
2017,  this  section  has  been  updated  to  §  1881a(k)(2)).  Thus,  because  the  FISC  did  not  complete 
its  review  of  the  2016  certifications  during  calendar  year  2016,  the  FISC  did  not  issue  an  order 
concerning  those  certifications  in  calendar  year  2016.  The  2015  order  remained  in  effect  during 
the  extension  period.  On  April  26,  2017,  the  FISC  issued  an  order  authorizing  the  2016 
certifications. 


Figure  3:  Table  of  Section  702  Orders 


Section  702  of  FISA 

CY2013 

CY2014 

CY2015 

CY2016 

CY2017 

Total  number  of  orders  issued 

1 

1 

1 

0 

1 

See  50  U.S.C.  §  1873(b)(2). 


Estimating  Section  702  targets.  The  number  of  702  "targets,"  provided  below,  reflects  an 
estimate  of  the  number  of  non-U. S.  persons  who  are  the  users  of  tasked  selectors.  This 
estimate  is  based  on  information  readily  available  to  the  1C.  Unless  and  until  the  1C  has 
information  that  links  multiple  selectors  to  a  single  foreign  intelligence  target,  each  individual 
selector  is  counted  as  a  separate  target  for  purposes  of  this  report.  On  the  other  hand,  where 
the  1C  is  aware  that  multiple  selectors  are  used  by  the  same  target,  the  1C  counts  the  user  of 
those  selectors  as  a  single  target.  This  counting  methodology  reduces  the  risk  that  the  1C  might 
inadvertently  understate  the  number  of  discrete  persons  targeted  pursuant  to  Section  702. 
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Figure  4:  Table  of  Section  702  Targets  (recall  that  only  non-USPs  are  targeted) 


Section  702  of  FISA 

CY2013 

CY2014 

CY2015 

CY2016 

CY2017 

Estimated  number  of  targets  of 

such  orders* 

89,138 

92,707 

94,368 

106,469 

129,080 

5ee50U.S.C.  §  1873(b)(2)(A). 

*  Previously  the  1C  was  not  statutorily  required  to  publicly  provide  this  statistic,  but  provided  it 
consistent  with  transparency  principles.  The  reauthorized  FAA  of  2017  codified  this 
requirement  at  50  U.S.C.  §  1873(b)(2)(A). 

C.  Statistics— U.S.  Person  Queries 

In  July  2014,  the  Privacy  and  Civil  Liberties  Oversight  Board  (PCLOB  or  Board)  issued  a  report  on 
Section  702  entitled,  “Report  on  the  Surveillance  Program  Operated  Pursuant  to  Section  702  of 
the  Foreign  Intelligence  Surveillance  Acf'  [PCLOB's  Section  702  Report),  which  reported  U.S. 
person  query  statistics  for  calendar  year  2013.  See  PCLOB's  Section  702  Report,  at  57-58.  The 
USA  FREEDOM  Act,  enacted  in  2015,  required  the  public  reporting  of  statistics  regarding  the 
number  of  U.S.  person  queries  of  Section  702.  Specifically,  the  Act  required  the  "number  of 
search  terms  concerning  a  known  United  States  person  used  to  retrieve  the  unminimized 
contents  [...]"  -  referred  as  guery  terms  of  content  -  and  "the  number  of  queries  concerning  a 
known  United  States  person  of  unminimized  noncontents  information  [...]"  -  referred  as 
gueries  of  metadata.  See  50  U.S.C.  §  1873(b)(2)(B)  and  (b)(2)(C),  respectively.  Thus,  ODNI  began 
reporting  on  these  statistics  in  the  Annual  Statistical  Transparency  Report  covering  calendar 
year  2015. 

Below  are  statistics  for  U.S.  person  queries  of  raw,  unminimized  Section  702-acquired  data.^ 
The  U.S.  person  statistics  are  based  on  (a)  approved  U.S.  person  guery  terms  used  to  query 


^  With  the  reauthorization  of  FAA  in  2017,  Congress  codified  new  requirements  regarding  the  access  of  results  of 
certain  queries  conducted  by  the  FBI.  Specifically  under  Section  702(f)(2)(A),  an  order  from  the  FISC  is  now 
required  before  the  FBI  can  review  the  contents  of  a  query  using  a  U.S.  person  query  term  when  the  query  was  not 
designed  to  find  and  extract  foreign  intelligence  information  and  was  performed  in  connection  with  a  predicated 
criminal  investigation  that  does  not  relate  to  national  security.  Before  the  FISC  may  issue  such  an  order  based  on  a 
finding  of  probable  cause,  an  FBI  officer  must  apply  in  writing,  to  include  the  officer's  justification  that  the  query 
results  would  provide  evidence  of  criminal  activity,  and  the  application  must  be  approved  by  the  Attorney  General. 
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Section  702  content  and  (b)  U.S.  person  queries  conducted  of  Section  702  noncontents  (i.e., 
metadata).  It  is  important  to  understand  that  these  two  very  different  numbers  cannot  be 
combined  because  they  use  different  counting  methodologies  (approved  query  terms  versus 
queries  conducted)  and  different  data  types  (content  versus  noncontents). 

Counting  approved  U.S.  person  query  terms  used  to  query  Section  702  content.  The  NSA 

counts  the  number  of  U.S.  person  identifiers  it  approved  to  query  the  content  of  unminimized 
Section  702-acquired  information.  For  example,  if  the  NSA  used  U.S.  person  identifier 
"johndoe(5)XYZprovider"  to  query  the  content  of  Section  702-acquired  information,  the  NSA 
would  count  it  as  one  regardless  of  how  many  times  the  NSA  used  "johndoe@XYZprovider"  to 
query  its  702-acquired  information.  The  CIA  started  using  this  model  in  2016  for  counting  query 
terms  and  those  statistics  were  included  in  the  Annual  Statistical  Transparency  Report  covering 
CY2016.  When  the  NCTC  began  receiving  raw  Section  702  information,  NCTC  followed  a  similar 
approach  of  counting  U.S.  person  query  terms  that  were  used  to  query  Section  702  content. 

Figure  5:  Illustration  of  how  the  1C  counts  approved  U.S.  person  query  terms  used  to  query 
Section  702  content 


Query  Events 


johndoe(S)XYZprovider 

johndoe@XYZprovider 

johndoe@XYZprovider 

johndoe@>123company 

marydoe@>XYZprovider 

marydoe@>XYZprovider 

Query  Terms  Used 

1. 

johndoe(5)XYZprovider 

2. 

johndoe@123company 

3. 

marydoe@XYZprovider 

Count  =  3  USP  Query  Terms 

(Not  counted  were  the  6  instances 
the  query  terms  queried 
the  content.) 


50  U.S.C.  Section  1873(b)(2)(A)  requires  annual  reporting  of  the  number  of  times  the  FBI  received  an  order 
pursuant  to  702(f)(2)(A);  this  statistic  will  be  provided  in  future  transparency  reports. 
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Figure  6a:  Table  of  U.S.  Person  Query  Terms  Used  to  Query  Section  702  Content 


Section  702  of  FISA 

CY2015 

CY2016 

CY2017 

Estimated  number  of  search  terms  concerning  a 
known  U.S.  person  used  to  retrieve  the 

unminimized  contents  of  communications  obtained 

under  Section  702  (excluding  search  terms  used  to 
prevent  the  return  of  U.S.  person  information)* 

4,672 

5,288 

7,512 

5ee50U.S.C.  §  1873(b)(2)(B). 

*  Consistent  with  50  U.S.C.  §  1873(d)(2)(A),  this  statistic  does  not  include  queries  that  are 
conducted  by  the  FBI.  However,  the  reauthorized  FAA  of  2017  codified  a  new  reporting 
requirement  for  the  FBI  under  50  U.S.C.  §  1873(b)(2)(D),  which  is  addressed  later  in  this  report. 


Figure  6b:  Chart  of  U.S.  Person  Query  Terms  Used  to  Query  Section  702  Content 


8,000 

7,000 

6,000 

5,000 

4,000 

3,000 

2,000 

1,000 

0 


Number  of  USP  Query  Terms 
used  to  query  the  content  of  Section  702  information* 


7,512 


5,288 

4,672 


CY2015  CY2016  CY2017 
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Counting  queries  using  U.S.  person  identifiers  of  noncontents  collected  under  Section  702. 

This  estimate  represents  the  number  of  times  a  U.S.  person  identifier  is  used  to  query  the 
noncontents  (i.e.,  metadata)  of  unminimized  Section  702-acquired  information.  For  example,  if 
the  U.S.  person  identifier  telephone  number  "111-111-2222"  was  used  15  times  to  query  the 
noncontents  of  Section  702-acquired  information,  the  number  of  queries  counted  would  be  15. 


Figure  7:  Illustration  of  how  the  1C  counts  U.S.  person  queries  of  Section  702  noncontents 


Queries  Events 


111-111-2222 

111-111-2222 

111-111-2222 

333-444-4444 

555-555-6666 

555-555-6666 

Raw  Section  702 

NON-CONTENTS 

(i.e.. 

Metadata) 

L 

J 

Querv  Terms  Approved 

1. 

111-111-2222 

2. 

333-444-4444 

3. 

555-555-6666 

Count  =  6  USP  Queries 

(Each  individual  query  event 
is  counted.) 


As  with  last  year's  transparency  report,  one  1C  element,  the  CIA,  remains  currently  unable  to 
provide  the  number  of  queries  using  U.S.  person  identifiers  of  unminimized  Section  702 
noncontents  information  for  CY2017.  Under  50  U.S.C.  §  1873(d)(3)(A),  if  the  DNI  concludes  that 
this  good-faith  estimate  cannot  be  determined  accurately  because  not  all  of  the  relevant 
elements  of  the  1C  are  able  to  provide  this  good  faith  estimate,  then  the  DNI  is  required  to  (i) 
certify  that  conclusion  in  writing  to  the  relevant  Congressional  committees;  (ii)  report  the  good 
faith  estimate  for  those  relevant  elements  able  to  provide  such  good  faith  estimate;  (iii)  explain 
when  it  is  reasonably  anticipated  that  such  an  estimate  will  be  able  to  be  determined  fully  and 
accurately;  and  (iv)  make  such  certification  publicly  available  on  an  Internet  web  site.  Because 
the  CIA  remained  unable  to  provide  such  information  for  calendar  year  2017,  the  DNI  made  a 
certification,  pursuant  to  50  U.S.C.  §  1873(d)(3)(A)  to  the  relevant  Congressional  committees. 

As  required  by  statute,  this  certification  is  being  made  publicly  available  as  an  attached 
appendix  to  this  current  report  (see  Appendix  A).  As  described  in  Appendix  A,  CIA  will  be  able  to 
provide  a  good  faith  estimate  of  these  queries  for  calendar  year  2018;  such  information  will  be 
included  in  the  2019  annual  transparency  report. 
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Figure  8:  Table  of  U.S.  Person  Queries  of  Noncontents  of  Section  702 


Section  702  of  FISA 

CY2013 

CY2014 

CY2015 

CY2016 

CY2017 

Estimated  number  of  queries 
concerning  a  known  U.S.  person  of 

unminimized  noncontents 

information  obtained  under 

Section  702  (excluding  queries 
containing  information  used  to 
prevent  the  return  of  U.S.  person 
information)* 

9,500 

17,500 

23,800 

30,355 

16,924 

5ee50U.S.C.  §  1873(b)(2)(C). 

*  Consistent  with  50  U.S.C.  §  1873(d)(2)(A),  this  statistic  does  not  include  queries  that  are 
conducted  by  the  FBI.  However,  the  reauthorized  FAA  of  2017  codified  a  new  reporting 
requirement  for  the  FBI  under  50  U.S.C.  §  1873(b)(2)(D),  which  was  addressed  earlier  in  this 
report. 

FISC  Order  Requiring  Certain  Section  702  Query  Reporting  by  FBI.  On  November  6,  2015,  the 
FISC  granted  the  government's  application  for  renewal  of  the  2015  certifications  and,  among 
other  things,  concluded  that  the  FBI's  U.S.  person  querying  provisions  in  its  minimization 
procedures,  "strike  a  reasonable  balance  between  the  privacy  interests  of  the  United  States 
persons  and  persons  in  the  United  States,  on  the  one  hand,  and  the  government's  national 
security  interests,  on  the  other."  Memorandum  Opinion  and  Order  dated  November  6,  2015,  at 
44  (released  on  1C  on  the  Record  on  April  19,  2016).  The  FISC  further  stated  that  the  FBI 
conducting  queries,  "designed  to  return  evidence  of  crimes  unrelated  to  foreign  intelligence 
does  not  preclude  the  Court  from  concluding  that  taken  together,  the  targeting  and 
minimization  procedures  submitted  with  the  2015  Certifications  are  consistent  with  the 
requirements  of  the  Fourth  Amendment."  Id. 

Nevertheless,  the  FISC  ordered  the  government  to  report  in  writing,  "each  instance  after 
December  4,  2015,  in  which  FBI  personnel  receive  and  review  Section  702-acquired  information 
that  the  FBI  identifies  as  concerning  a  United  States  person  in  response  to  a  query  that  is  not 
designed  to  find  and  extract  foreign  intelligence  information."  (Emphasis  added).  Id.  at  44  and 
78.  The  FISC  directed  that  the  report  contain  details  of  the  query  terms,  the  basis  for 
conducting  the  query,  the  manner  in  which  the  query  will  be  or  has  been  used,  and  other 
details.  Id.  at  78.  In  keeping  with  the  IC's  Principles  of  Transparency,  the  DNI  declassified  the 
number  of  each  such  query  reported  to  the  FISC  in  calendar  year  2016.  This  year,  the  DNI  has 
again  declassified  the  number  reported  for  calendar  year  2017,  as  noted  in  Figure  10. 
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Figure  9:  Table  Regarding  Required  Section  702  Query  Reporting  to  the  FISC 


Section  702  of  FISA 

CY2016 

CY2017 

Per  the  FISC  Memorandum  Opinion  and  Order  dated 

November  6,  2015:  Each  reported  instance  in  which  FBI 
personnel  received  and  reviewed  Section  702-acquired 
information  that  the  FBI  identified  as  concerning  a  U.S. 
person  in  response  to  a  query  that  was  designed  to  return 
evidence  of  a  crime  unrelated  to  foreign  intelligence. 

1 

0 

D.  Section  702  and  FBI  Investigations. 

The  reauthorized  FAA  of  2017  now  requires  that  the  FBI  report  on  the  number  of  instances  in 
which  the  FBI  opened  a  criminal  investigation  of  a  U.S.  person,  who  is  not  considered  a  threat 
to  national  security,  based  wholly  or  in  part  on  Section  702-acquired  information.  See  50  U.S.C. 
§  1873(b)(2)(D).  This  statistic  will  provide  transparency  with  regard  to  how  often  Section  702 
collection  is  used  for  non-national  security  investigations  conducted  by  the  FBI.  Figure  10 
provides  the  required  statistic. 


Figure  10:  Table  Regarding  Number  of  FBI  Investigations  Opened  on  USPs  Based  on  Section 
702  Acquisition 


Section  702  of  FISA 

CY2017 

The  number  of  instances  in  which  the  FBI  opened,  under  the  Criminal 
Investigative  Division  or  any  successor  division,  an  investigation  of  a 

U.S.  person  (who  is  not  considered  a  threat  to  national  security)  based 
wholly  or  in  part  on  an  acquisition  authorized  under  Section  702. 

0 

See  50  U.S.C.  §  1873(b)(2)(D). 


19  I  P  a  g  e 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1171  of  1298 


NSA  Dissemination  of  U.S.  Person  Information  under  FISA  Section  702 


A.  Section  702 

In  July  2014,  the  PCLOB's  Section  702  Report  contained  10  recommendations.  Recommendation 
9  focused  on  "accountability  and  transparency,"  noting  that  the  government  should  implement 
measures,  "to  provide  insight  about  the  extent  to  which  the  NSA  acquires  and  utilizes  the 
communications  involving  U.S.  persons  and  people  located  in  the  United  States  under  the 
Section  702  program."  PCLOB's  Section  702  Report  at  145-146.  Specifically,  the  PCLOB 
recommended  that  "the  NSA  should  implement  processes  to  annually  count  [...]  (5)  the  number 
of  instances  in  which  the  NSA  disseminates  non-public  information  about  U.S.  persons, 
specifically  distinguishing  disseminations  that  includes  names,  titles,  or  other  identifiers,  such 
as  telephone  numbers  or  e-mail  addresses,  potentially  associated  with  individuals."  Id.  at  146. 
This  recommendation  is  commonly  referred  to  as  Recommendation  9(5).  In  response  to  the 
PCLOB's  July  2014  Recommendation  9(5),  NSA  previously  publicly  provided  (in  the  Annual 
Statistical  Transparency  Report  for  calendar  year  2015)  and  continues  to  provide  the  following 
additional  information  regarding  the  dissemination  of  Section  702  intelligence  reports  that 
contain  U.S.  person  information.  Because  the  PCLOB  issued  its  recommendation  in  2014,  these 
statistics  were  not  included  in  Annual  Statistical  Transparency  Report  for  calendar  years  2013  or 
2014. 

NSA  has  been  providing  similar  information  to  Congress  since  2009,  in  classified  form,  per  FISA 
reporting  requirements.  For  example,  FISA  Section  702(m)(3)  requires  that  NSA  annually  submit 
a  report  to  applicable  Congressional  committees  regarding  certain  numbers  pertaining  to  the 
acquisition  of  Section  702-acquired  information,  including  the  number  of  "disseminated 
intelligence  reports  containing  a  reference  to  a  United  States  person  identity."  See  50  U.S.C. 

§  1881a(m)(A)(3)(i)  (prior  to  the  reauthorized  FAA  of  2017under  §  1881a(l)(3)(A)(i)).  Section 
702a(m)(A)(3)  also  requires  that  the  number  of  "United  States-person  identities  subsequently 
disseminated  by  [NSA]  in  response  to  request  for  identities  that  were  not  referred  to  by  name 
or  title  in  the  original  reporting."  See  50  U.S.C.  §  1881a(m)(3)(A)(ii).  This  second  requirement 
refers  to  NSA  providing  the  number  of  approved  unmasking  requests,  which  is  explained  below. 
Additionally,  NSA  provides  the  number  of  NSA's  disseminated  intelligence  reports  containing  a 
U.S.  person  reference  to  Congress  as  part  of  the  Attorney  General  and  the  DNI's  joint 
assessment  of  compliance.  See  50  U.S.C.  §  1881a(m)(l)  (prior  to  the  reauthorized  FAA  of 
2017under§  1881a(l)(l)). 

Prior  to  the  PCLOB  issuing  its  Section  702  Report,  NSA's  Director  of  the  Civil  Liberties,  Privacy, 
and  Transparency  Office  published  "NSA's  Implementation  of  Foreign  Intelligence  Surveillance 
Act  Section  702,"  on  April  16,  2014,  (hereinafter  "NSA  DCLPO  Report"),  in  which  it  explained 
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NSA's  dissemination  processes.  NSA  DCLPO  Report  at  7-8.  NSA  "only  generates  classified 
intelligence  reports  when  the  information  meets  a  specific  intelligence  requirement,  regardless 
of  whether  the  proposed  report  contains  U.S.  person  information."  NSA  DCLPO  Report  at  7. 

Section  702  only  permits  the  targeting  of  non-U. S.  persons  reasonably  believed  to  be  located 
outside  the  United  States  to  acquire  foreign  intelligence  information.  Such  targets,  however, 
may  communicate  information  to,  from,  or  about  U.S.  persons.  NSA  minimization  procedures 
(publicly  released  on  May  11,  2017)  permit  the  NSA  to  disseminate  U.S  person  information  if 
the  NSA  masks  the  information  that  could  identify  the  U.S.  person.  The  minimization 
procedures  also  permit  NSA  to  disseminate  the  U.S.  person  identity  only  if  doing  so  meets  one 
of  the  specified  reasons  listed  in  NSA's  minimization  procedures,  including  that  the  U.S.  person 
consented  to  the  dissemination,  the  U.S.  person  information  was  already  publicly  available,  the 
U.S.  person  identity  was  necessary  to  understand  foreign  intelligence  information,  or  the 
communication  contained  evidence  of  a  crime  and  is  being  disseminated  to  law  enforcement 
authorities.  Even  if  one  these  conditions  applies,  as  a  matter  of  policy,  NSA  may  still  mask  the 
U.S.  person  information  and  will  include  no  more  than  the  minimum  amount  of  U.S.  person 
information  necessary  to  understand  the  foreign  intelligence  or  to  describe  the  crime  or  threat. 
Id.  In  certain  instances,  however,  NSA  makes  a  determination  prior  to  releasing  its  original 
classified  report  that  the  U.S.  person's  identity  is  appropriate  to  disseminate  in  the  first 
instance  using  the  same  standards  discussed  above. 

Masked  U.S.  Person  Information.  Agency  minimization  procedures  generally  provide  for  the 
substitution  of  a  U.S.  person  identity  with  a  generic  phrase  or  term  if  the  identity  otherwise 
does  not  meet  the  dissemination  criteria;  this  is  informally  referred  to  as  "masking"  the  identity 
of  the  U.S.  person.  Information  about  a  U.S.  person  is  masked  when  the  identifying  information 
about  the  person  is  not  included  in  a  report.  For  example,  instead  of  reporting  that  Section  702- 
acquired  information  revealed  that  non-U. S.  person  "Bad  Guy"  communicated  with  U.S.  person 
"John  Doe"  (i.e.,  the  actual  name  of  the  U.S.  person),  the  report  would  mask  "John  Doe's" 
identity,  and  would  state  that  "Bad  Guy"  communicated  with  "an  identified  U.S.  person,"  "a 
named  U.S.  person,"  or  "a  U.S.  person." 

Unmasking  U.S.  Person  Information.  Recipients  of  NSA's  classified  reports,  such  as  other 
federal  agencies,  may  request  that  NSA  provide  the  U.S.  person  identity  that  was  masked  in  an 
intelligence  report.  The  requested  identity  information  is  released  only  if  the  requesting 
recipient  has  a  "need  to  know"  the  identity  of  the  U.S.  person  and  if  the  dissemination  of  the 
U.S.  person's  identity  would  be  consistent  with  NSA's  minimization  procedures  (e.g.,  the 
identity  is  necessary  to  understand  foreign  intelligence  information  or  assess  its  importance), 
and  additional  approval  has  been  provided  by  a  designated  NSA  official. 
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As  part  of  their  regular  oversight  reviews,  DOJ  and  ODNI  review  disseminations  of  information 
about  U.S.  persons  that  NSA  obtained  pursuant  to  Section  702  to  ensure  that  the 
disseminations  were  performed  in  compliance  with  the  minimization  procedures. 

Additional  information  describing  how  the  1C  protects  U.S.  person  information  obtained 
pursuant  to  FISA  provisions  is  provided  in  recent  reports  by  the  civil  liberties  and  privacy  officers 
for  the  ODNI  (including  NCTC),  NSA,  FBI,  and  CIA.  The  reports  collectively  documented  the 
rigorous  and  multi-layered  framework  that  safeguards  the  privacy  of  U.S.  person  information  in 
FISA  disseminations.  See  ODNI  Report  on  Protecting  U.S.  Person  Identities  in  Disseminations 
under  FISA  and  annexes  containing  agency  specific  reports 

B.  Statistics 

Below  are  statistics  and  charts  to  further  explain  how  NSA  disseminates  U.S.  person 
information  incidentally  acquired  from  Section  702  in  classified  intelligence  reports.  NSA  may: 

i.  openly  name  (i.e.,  originally  reveal)  the  U.S.  person  in  the  report, 

ii.  initially  mask  (i.e.,  not  reveal)  the  U.S.  person  identity  in  the  report,  or 

iii.  in  the  instances  where  the  U.S.  person  identity  was  initially  masked,  upon  a  specific 
request,  later  reveal  and  unmask  the  U.S.  person  identity  but  only  to  the  requestor. 

This  year's  report  presents  the  dissemination  numbers  in  a  different  format  from  the  previous 
report  to  facilitate  understanding  and  to  provide  consistency  with  NSA's  classified  FISA  Section 
702(m)(3)  reports  to  Congress.  This  report  separates  the  number  of  reports  (in  Figure  11)  from 
the  statistics  relating  to  the  U.S.  person  identities  later  disseminated  (in  Figure  12). 

NSA  applies  its  minimization  procedures  in  preparing  its  classified  intelligence  reports,  and  then 
disseminates  the  reports  to  authorized  recipients  with  a  need  to  know  the  information  in  order 
to  perform  their  official  duties.  Very  few  of  NSA's  intelligence  reports  from  Section  702 
collection  contain  references  to  U.S.  person  identities  (whether  masked  or  openly  named). 

The  first  row  of  Figure  11  provides  "an  accounting  of  the  number  of  disseminated  intelligence 
reports  containing  a  reference  to  a  United  States-person  identity."  See  50  U.S.C. 

§  1881a(m)(3)(A)(i).  Note  that  a  single  report  could  contain  multiple  U.S.  person  identities, 
masked  and/or  openly  named.  NSA's  counting  methodology  is  to  include  any  disseminated 
intelligence  report  that  contains  a  reference  to  one  or  more  U.S.  person  identities,  whether 
masked  or  openly  named,  even  if  the  report  includes  information  from  other  sources.  NSA  does 
not  maintain  records  that  allow  it  to  readily  determine,  in  the  case  of  an  intelligence  report  that 
includes  information  from  several  sources,  from  which  source  a  reference  to  a  U.S.  person 
identity  was  derived.  Accordingly,  the  references  to  U.S.  person  identities  may  have  resulted 
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from  Section  702  authorized  collection  or  from  other  authorized  signals  intelligence  activity 
conducted  by  NSA.  This  counting  methodology  was  used  in  the  previous  report  and  is  used  in 
NSA's  FISA  Section  702(m)(3)  report.  As  noted  above,  a  U.S.  person  is  "a  citizen  of  the  United 
States,  an  alien  lawfully  admitted  for  permanent  residence  (as  defined  in  section  101(a)(20)  of 
the  Immigration  and  Nationality  Act),  an  unincorporated  association  a  substantial  number  of 
members  of  which  are  citizens  of  the  United  States  or  aliens  lawfully  admitted  for  permanent 
residence,  or  a  corporation  which  is  incorporated  in  the  United  States,  but  does  not  include  a 
corporation  or  an  association  which  is  a  foreign  power,  as  defined  in  [50  U.S.C.  §  1801(a)(1),  (2), 
or  (3)]."  See  50  U.S.C.  §  1801(i). 

The  second  row  of  Figure  11  provides  the  number  of  reports  containing  U.S.  person  identities 
where  the  U.S.  person  identity  was  masked  in  the  report.  The  third  row  provides  the  number  of 
reports  containing  U.S.  person  identities  where  the  U.S.  person  was  openly  named  in  the  report. 


Figure  11:  Table  of  Section  702  Reports  Containing  USP  information  unmasked  by  NSA 


Section  702  Reports  Containing  U.S.  person  (USP) 

CY2016 

CY2017 

information  disseminated  by  NSA 

Reports  -  Total  number  of  NSA  disseminated  §702  reports 
containing  USP  identities  regardless  of  whether  the  identity 
was  openly  named  or  masked. 

3,914 

4,065 

Reports  -  Total  number  of  NSA  disseminated  §702  reports 
containing  USP  identities  where  the  USP  identity  was  masked. 

2,964 

3,034 

Reports  -  Total  number  of  NSA  disseminated  §702  reports 
containing  USP  identities  where  the  USP  was  openly  named. 

1,200 

1,341 

As  explained  above,  rows  2  and  3  will  not  total  row  1  because  one  report  may  contain  both 
masked  and  openly  namely  identities. 


Figure  12  provides  statistics  relating  to  the  numbers  of  U.S.  person  identities  that  were 
originally  masked  in  those  reports  counted  in  Figure  11  but  which  NSA  later  provided  to 
authorized  requestors  (i.e.,  unmasked)  during  CY2017.  This  statistic  is  the  number  required  to 
be  reported  to  Congress  in  NSA's  FISA  Section  702(m)(3)  report.  In  other  words.  Figure  12 
provides  "an  accounting  of  the  number  of  United  States-person  identities  subsequently 
disseminated  by  [NSA]  in  response  to  requests  for  identities  that  were  not  referred  to  by  name 
or  title  in  the  original  reporting."  See  50  U.S.C.  §  1881a(m)(3)(A)(ii).  This  number  is  different 
than  numbers  provided  in  either  CY2015  or  the  CY2016  Annual  Statistical  Transparency  Report. 
NSA  has  decided  to  declassify  the  total  number  of  U.S.  person  identities  unmasked  in  response 
to  a  request.  The  U.S.  person  identities  include  individuals  as  well  as  non-individual  entities 


23  I  P  a  g  e 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1175  of  1298 


whose  identities  NSA  masks  pursuant  to  law  or  policy.  These  non-individual  entities,  include,  for 
example,  U.S.  IP  addresses  and  artificial  "persons"  such  as  corporations. 

Previously,  the  Annual  Statistical  Transparency  Report  focused  on  responding  to  the  PCLOB's 
report  recommendation  9(5)  by  counting  only  those  U.S.  person  identities  where  the  proper 
name  or  title  of  an  individual  was  unmasked;  it  did  not  count  any  other  unmasking  such  as 
email  addresses  or  telephone  numbers  or  U.S.  IP  addresses  or  U.S.  corporations.  Rather  than 
distinguishing  between  the  different  ways  a  U.S.  person  might  be  named  in  an  intelligence 
report,  NSA  will  provide  the  total  number  of  U.S.  person  identities  unmasked  in  response  to  a 
specific  request  from  another  agency  whether  it  is  a  title  of  an  individual,  an  identifier  such  as 
an  email  address,  an  IP  address  or  a  corporation.  Thus,  this  current  Annual  Statistical 
Transparency  Report,  in  Figure  12,  reports  that  same  metric  that  is  reported  in  NSA's  FISA 
Section  702(m)(3).  However,  because  NSA's  FISA  Section  702(m)(3)  reports  have  a  time  period 
of  September  through  August,  comparing  the  two  reporting  years  is  not  an  exact  comparison. 


Figure  12:  Table  of  Section  702  USP  Identities  disseminated  by  NSA 


Section  702  -  U.S.  person  (USP)  identities 
unmasked  by  NSA 


The  number  of  U.S.  person  identities  that  NSA 
unmasked  in  response  to  a  specific  request  from 
another  agency. 


12  month  period 
Sep  2015-Aug  2016 


9,217 


CY2017 


9,529 


Beginning  with  next  year's  transparency  report  (due  April  2019),  ODNI  will  report  statistics 
pertaining  to  how  the  1C  disseminates  U.S.  person  information  regardless  of  the  legal  authority 
under  which  the  information  was  collected  (not  only  FISA  Section  702).  See  ICPG  107.1 
Specifically,  ODNI  will  report  (1)  the  total  number  of  requests  to  identify  U.S.  persons,  whose 
identity  was  originally  omitted,  in  disseminated  intelligence  reports,  (2)  the  total  number  of 
those  requests  approved,  and  (3)  the  total  number  of  those  requests  denied. 
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FISA  Criminal  Use  and  Notice  Provisions 


A.  FISA  Sections  106  and  305 

FISA  Section  106  requires  advance 
authorization  from  the  Attorney 
General  before  any  information 
acquired  through  Title  I  electronic 
surveillance  may  be  used  in  a  criminal 
proceeding.  This  authorization  from  the 
Attorney  General  is  defined  to  include 
authorization  by  the  Acting  Attorney 
General,  Deputy  Attorney  General,  or, 
upon  designation  by  the  Attorney 
General,  the  Assistant  Attorney  General 
for  National  Security.  Section  106  also 
requires  that  if  a  government  entity 
intends  to  introduce  into  evidence  in 
any  trial,  hearing,  or  other  proceeding, 
against  an  aggrieved  person, 
information  obtained  or  derived  from 
electronic  surveillance,  it  must  notify 
the  aggrieved  person  and  the  court. 

The  aggrieved  person  is  then  entitled  to 
seek  suppression  of  the  information.  FISA  Section  706  requires  that  any  information  acquired 
pursuant  to  Section  702  be  treated  as  electronic  surveillance  under  Title  I,  including  for 
purposes  of  the  use,  notice,  and  suppression  requirements  under  Section  106. 

FISA  Section  305  provides  the  same  requirements  for  information  acquired  through  Title  III 
physical  search  (i.e.,  advance  authorization,  notice,  and  opportunity  to  suppress). 

B.  Statistics 

The  reauthorized  FAA  of  2017codified  that  certain  statistics  concerning  criminal  proceedings 
must  be  provided  to  the  public  pertaining  to  Sections  106  and  305,  including  Section  702- 
acquired  information.  Specifically,  figure  13  provides  that,  in  2017,  the  Government  filed  notice 
of  intent  to  use  FISA-acquired  information,  pursuant  to  Section  106  or  305,  in  seven  (7) 
separate  criminal  proceedings. 


FISA  Sections  106  and  305 
-  Criminal  Use  and  Notice  Provisions  - 

Commonly  referred  to  as  the  "criminal  use  provision." 

-^Section  106  applies  to  information  acquired  from  Title  I 
electronic  surveillance;  Section  305  applies  to  information 
acquired  from  Title  III  physical  search. 

-^Attorney  General  advance  authorization  is  required 
before  such  information  may  be  used  in  a  criminal 
proceeding;  if  such  information  is  used  or  intended  to  be 
used  against  an  aggrieved  person,  that  person  must  be 
given  notice  of  the  information  and  hove  a  chance  to 
suppress  the  information. 

The  reauthorized  FAA  of  2017  codified  that  statistics 
must  be  provided  to  the  public  os  it  pertained  to  Section 
106,  Section  305,  os  well  os  Section  702  acquired 
information. 
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Figure  13:  Table  Regarding  Number  of  Criminal  Proceedings  in  which  the  Government 
Provided  Notice  of  Its  Intent  to  Use  Cert  FISA  Information 


FISA  Sections  106  and  305 

CY2017 

The  number  of  criminal  proceedings  in  which  the  United  States  or  a  State  or 
political  subdivision  thereof  provided  notice  pursuant  to  Section  106 
(including  with  respect  to  Section  702-acquired  information)  or  Section  305 
of  the  government's  intent  to  enter  into  evidence  or  otherwise  use  or 
disclose  any  information  obtained  or  derived  from  electronic  surveillance, 
physical  search,  or  Section  702  acquisition. 

7 
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FISA  Title  IV  -  Use  of  Pen  Register  and  Trap  and  Trace  (PR/TT)  Devices 

A.  FISA  PR/TT  Authority 

Title  IV  of  FISA  authorizes  the  use  of  pen 
register  and  trap  and  trace  (PR/TT) 
devices  for  foreign  intelligence  purposes. 

Title  IV  authorizes  the  government  to  use 
a  PR/TT  device  to  seek  and  capture 
dialing,  routing,  addressing  or  signaling 
(DRAS)  information.  The  government 
may  submit  an  application  to  the  FISC  for 
an  order  approving  the  use  of  a  PR/TT 
device  (i.e.,  PR/TT  order)  for  (i)  "any 
investigation  to  obtain  foreign 
intelligence  information  not  concerning  a 
United  States  person  or"  (ii)  "to  protect 
against  international  terrorism  or 
clandestine  intelligence  activities, 
provided  that  such  investigation  of  a 
United  States  person  is  not  conducted 
solely  upon  the  basis  of  activities 
protected  by  the  First  Amendment  to  the  Constitution."  50  U.S.C.  §  1842(a).  If  the  FISC  finds 
that  the  government's  application  sufficiently  meets  the  requirements  of  FISA,  the  FISC  must 
issue  an  order  for  the  installation  and  use  of  a  PR/TT  device. 

B.  Statistics 

Counting  orders.  Similar  to  how  orders  were  counted  for  Titles  I  and  III  and  Sections  703  and 
704,  this  report  only  counts  the  orders  granting  authority  to  conduct  intelligence  collection  - 
the  order  for  the  installation  and  use  of  a  PR/TT  device.  Thus,  renewal  orders  are  counted  as  a 
separate  order;  modification  orders  and  amendments  are  not  counted. 

Estimating  the  number  of  targets.  The  government's  methodology  for  counting  PR/TT  targets  is 
similar  to  the  methodology  described  above  for  counting  targets  of  electronic  surveillance 
and/or  physical  search.  If  the  1C  received  authorization  for  the  installation  and  use  of  a  PR/TT 
device  against  the  same  target  in  four  separate  applications,  the  1C  would  count  one  target,  not 


FISA  Title  IV 

Commonly  referred  to  os  the  "PR/TT"  provision. 

Bulk  collection  is  prohibited. 

Reguires  individual  FISC  order  to  use  PR/TT  device  to 
capture  dialing,  routing,  addressing,  or  signaling  (DRAS) 
information. 

Government  reguest  to  use  a  PR/TT  device  on  U.S. 
person  target  must  be  based  on  an  investigation  to 
protect  against  terrorism  or  clandestine  intelligence 
activities  and  that  investigation  must  not  be  based  solely 
on  the  basis  of  activities  protected  by  the  First 
Amendment  to  the  Constitution. 
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four.  Alternatively,  if  the  1C  received  authorization  for  the  installation  and  use  of  a  PR/TT  device 
against  four  targets  in  the  same  application,  the  1C  would  count  four  targets. 

Estimating  the  number  of  unique  identifiers.  This  statistic  counts  (1)  the  targeted  identifiers 
and  (2)  the  non-targeted  identifiers  (e.g.,  telephone  numbers  and  e-mail  addresses)  that  were 
in  contact  with  the  targeted  identifiers.  Specifically,  the  House  Report  on  the  USA  FREEDOM  Act 
states  that  "[t]he  phrase  'unique  identifiers  used  to  communicate  information  collected 
pursuant  to  such  orders'  means  the  total  number  of,  for  example,  email  addresses  or  phone 
numbers  that  have  been  collected  as  a  result  of  these  particular  types  of  FISA  orders-not  just 
the  number  of  target  email  addresses  or  phone  numbers."  [H.R.  Rept.  114-109  Part  I,  p.  26], 
with  certain  exceptions  noted. 


Figure  14:  Table  of  PR/TT  Orders,  Targets,  and  Unique  Identifiers  Collected 


Title  IV  of  FISA 

PR/TT  FISA 

CY2013 

CY2014 

CY2015 

CY2016 

CY2017 

Total  number  of  orders 

131 

135 

90 

60 

33 

Estimated  number  of  targets  of 

such  orders 

319 

516 

456 

41 

27 

Estimated  number  of  unique 

identifiers  used  to  communicate 

information  collected  pursuant 

to  such  orders* 

134,987" 

81,035"^ 

56,064" 

See  50  U.S.C.  §§  1873(b)(3),  1873(b)(3)(A),  and 

1  1873(b)(3) 

B). 

*  Pursuant  to  §1873(d)(2)(B),  this  statistic  does  not  apply  to  orders  resulting  in  the  acquisition 
of  information  by  the  FBI  that  does  not  include  electronic  mail  addresses  or  telephone 
numbers. 

''This  number  represents  information  the  government  received  from  provider(s)  electronically 
for  the  entire  calendar  year.  The  government  does  not  have  a  process  for  capturing  unique 
identifiers  received  by  other  means  (such  as  hard-copy  or  portable  media), 
t  Last  year,  the  FBI  mistakenly  interchanged  the  number  of  unique  identifiers  for  business 
records  and  PR/TT  orders,  reporting  the  number  of  business  records  unique  identifiers  as  PR/TT 
unique  identifiers  and  vice  versa.  This  report  corrects  the  error  and  accurately  identifies  the 
legal  authority  under  which  the  FBI  obtained  the  unique  identifiers. 
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Figure  15:  Table  of  FISA  PR/TT  Targets  -  U.S.  Persons  and  Non-U.S.  Persons* 


PR/TT  Targets 

CY2016 

CY2017 

Estimated  number  of  targets  who  are  non-U. S.  persons 

23 

16 

Estimated  number  of  targets  who  are  U.S.  persons 

18 

11 

Estimated  percentage  of  targets  who  are  U.S.  persons 

43.9% 

40.7% 

See  50  U.S.C.  §§1873(b)(3)(A)(i)  and  1873(b)(3)(A)(ii)  for  rows  one  and  two,  respectively. 

*  Previously  the  1C  was  not  statutorily  required  to  publicly  provide  these  statistics,  but  provided 
them  consistent  with  transparency  principles.  The  reauthorized  FAA  of  2017  codified  this 
requirement  at  50  U.S.C.  §§  1873(b)(3)(A)(i)  and  1873(b)(3)(A)(ii). 
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FISA  Title  V  -  Business  Records 


A.  Business  Records  FISA 

Under  FISA,  Title  V  authorizes  the 
government  to  submit  an  application  for 
an  order  requiring  the  production  of  any 
tangible  things  for  (i)  "an  investigation  to 
obtain  foreign  intelligence  information  not 
concerning  a  United  States  person  or"  (ii) 

"to  protect  against  international  terrorism 
or  clandestine  intelligence  activities, 
provided  that  such  investigation  of  a 
United  States  person  is  not  conducted 
solely  upon  the  basis  of  activities 
protected  by  the  First  Amendment  to  the 
Constitution."  50  U.S.C.  §  1861.  Title  V  is 
commonly  referred  to  as  the  "Business 
Records"  provision  of  FISA. 

In  June  2015,  the  USA  FREEDOM  Act  was 
signed  into  law  and,  among  other  things,  it 
amended  Title  V,  including  by  prohibiting 
bulk  collection. See  50  U.S.C.  §§  1861(b),  1861(k)(4).  The  DNI  is  required  to  report  various 
statistics  about  two  Title  V  provisions  -  traditional  business  records  and  call  detail  records 
(discussed  further  below).  On  November  28,  2015,  in  compliance  with  amendments  enacted  by 
the  USA  FREEDOM  Act,  the  1C  terminated  collection  of  bulk  telephony  metadata  under  Title  V 
of  the  FISA  (the  "Section  215  Program").  Solely  due  to  legal  obligations  to  preserve  records  in 
certain  pending  civil  litigation,  including  First  Unitarian  Church  of  Los  Angeles,  etai.  v.  National 
Security  Agency,  et  al.,  No.  C  13-03287-JSW  (N.D.  Cal.)  and  Jewel,  et  al.  v.  National  Security 
Agency,  et  al.,  No.  C  08-04373-JSW  (N.D.  Cal.),  the  1C  continues  to  preserve  previously  collected 
bulk  telephony  metadata.  Under  the  terms  of  a  FISC  order  dated  November  24,  2015,  the  bulk 
telephony  metadata  cannot  be  used  or  accessed  for  any  purpose  other  than  compliance  with 
preservation  obligations.  Once  the  government's  preservation  obligations  are  lifted,  the 
government  is  required  to  promptly  destroy  all  bulk  metadata  produced  by 
telecommunications  providers  under  the  Section  215  Program. 


FISA  Title  V 

Commonly  referred  to  os  "Business  Records" 
provision. 

Bulk  collection  is  prohibited. 

Coll  Detail  Records  (CDRs)  may  be  obtained  from  a 
telephone  company  if  the  FISC  issues  on  individual  court 
order  for  target's  records. 

Reguest  for  records  in  on  investigation  of  a  U.S. 
person  must  be  based  on  an  investigation  to  protect 
against  terrorism  or  clandestine  intelligence  activities 
and  provided  that  the  investigation  is  not  conducted 
solely  upon  activities  protected  by  the  First  Amendment 
to  the  Constitution. 
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As  noted  in  last  year’s  Annual  Statistical  Transparency  Report,  on  November  30,  2015,  the  1C 
implemented  certain  provisions  of  the  USA  FREEDOM  Act,  including  the  call  detail  records 
provision  and  the  requirement  to  use  a  specific  selection  term.  Accordingly,  only  one  month's 
worth  of  data  for  calendar  year  2015  was  available  with  respect  to  those  provisions.  Any 
statistical  information  relating  to  a  particular  FISA  authority  for  a  particular  month  remains 
classified.  Therefore,  the  Title  V  data  specifically  associated  with  December  2015  was  only 
released  in  a  classified  annex  provided  to  Congress  as  part  of  the  report  for  CY2015.  For  the  CY 
2016  report,  statistical  information  was  collected  for  an  entire  year  under  the  USA  FREEDOM 
Act  Title  V  provisions.  As  a  result,  those  statistics  were  included  in  that  report.  For  the  CY  2017 
report,  statistical  information  was  collected  for  an  entire  year  under  the  USA  FREEDOM  Act 
Title  V  provisions.  As  a  result,  those  statistics  are  included  in  this  report. 

Statistics  related  to  traditional  business  records  under  Title  V  Section  501(b)(2)(B)  are  provided 
first  pursuant  to  50  U.S.C.  §  1873(b)(5).  Statistics  related  to  call  detail  records  under  Title  V 
Section  501(b)(2)(C)  are  provided  second  pursuant  to  50  U.S.C.  §  1873(b)(6). 

B.  Statistics  -  "Traditional"  Business  Records  Statistics  Orders,  Targets  & 
Identifiers 

Business  Record  (BR)  requests  for  tangible  things  include  books,  records,  papers,  documents, 
and  other  items  pursuant  to  50  U.S.C.  §1861(b)(2)(B),  also  referred  to  as  Section  501(b)(2)(B) . 
These  are  commonly  referred  to  as  "Traditional"  Business  Records. 

Estimating  the  number  of  unique  identifiers.  This  is  an  estimate  of  the  number  of  (1)  targeted 
identifiers  (e.g.,  telephone  numbers  and  email  addresses)  and  (2)  non-targeted  identifiers  that 
were  in  contact  with  the  targeted  identifiers.  This  metric  represents  unique  identifiers  received 
electronically  from  the  provider(s).  The  government  does  not  have  a  process  for  capturing 
unique  identifiers  received  by  other  means  (i.e.,  hard-copy  or  portable  media). 

Explaining  how  we  count  BR  statistics.  As  an  example  of  the  government's  methodology, 
assume  that  in  2017,  the  government  submitted  a  BR  request  targeting  "John  Doe"  with  email 
addresses  john.doe@serviceproviderX,  john.doe@serviceproviderY,  and 
john.doe@serviceproviderZ.  The  FISC  found  that  the  application  met  the  requirements  of  Title 
V  and  issued  orders  granting  the  application  and  directing  service  providers  X,  Y,  and  Z  to 
produce  business  records  pursuant  to  Section  501(b)(2)(B).  Provider  X  returned  10  non- 
targeted  email  addresses  that  were  in  contact  with  the  target;  provider  Y  returned  10  non- 
targeted  email  addresses  that  were  in  contact  with  the  target;  and  provider  Z  returned  10  non- 
targeted  email  addresses  that  were  in  contact  with  the  target.  Based  on  this  scenario,  we  would 
report  the  following  statistics:  A)  one  order  by  the  FISC  for  the  production  of  tangible  things,  B) 
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one  target  of  said  orders,  and  C)  33  unique  identifiers,  representing  three  targeted  email 
addresses  plus  30  non-targeted  email  addresses. 


Figure  16:  Table  of  "Traditional"  Business  Records  Orders,  Targets,  and  Unique  Identifiers 
Collected 


Business  Records  "BR"  -  Section  501(b)(2)(B) 

CY2016 

CY2017 

Total  number  of  orders  issued  pursuant  to  applications  under 
Section  501(b)(2)(B) 

84 

77 

Estimated  number  of  targets  of  such  orders 

88 

74 

Estimated  number  of  unique  identifiers  used  to  communicate 
information  collected  pursuant  to  such  orders 

125,354t 

87,834 

See  50  U.S.C.  §§  1873(b)(5),  1873(b)(5)(A),  and  1873(b)(5)(B). 

t  Last  year,  the  FBI  mistakenly  interchanged  the  number  of  unique  identifiers  for  business 
records  and  PR/TT  orders,  reporting  the  number  of  business  records  unique  identifiers  as  PR/TT 
unique  identifiers  and  vice  versa.  This  report  corrects  the  error  and  accurately  identifies  the 
legal  authority  under  which  the  FBI  obtained  the  unique  identifiers. 

C.  Statistics  -  Call  Detail  Record  (CDR)  Orders,  Targets  &  Identifiers 

Call  Detail  Records  (CDRs)  -  commonly  referred  to  as  "call  event  metadata"  -  may  be  obtained 
from  traditional  telecommunications  providers  pursuant  to  50  U.S.C.  §1861(b)(2)(C).  A  CDR  is 
defined  as  session  identifying  information  (such  as  originating  or  terminating  telephone 
number,  an  International  Mobile  Subscriber  Identity  (IMSI)  number,  or  an  International  Mobile 
Station  Equipment  Identity  (IMEI)  number),  a  telephone  calling  card  number,  or  the  time  or 
duration  of  a  call.  See  50  U.S.C.  §1861(k)(3)(A).  CDRs  provided  to  the  government  do  not 
include  the  content  of  any  communication,  the  name,  address,  or  financial  information  of  a 
subscriber  or  customer,  or  cell  site  location  or  global  positioning  system  information.  See  50 
U.S.C.  §1861(k)(3)(B).  CDRs  are  stored  and  queried  by  the  service  providers.  See  50  U.S.C. 
§1861(c)(2). 


Estimating  the  number  of  targets  of  CDR  orders.  A  "target"  is  the  person  using  the  selector.  For 
example,  if  a  target  uses  four  selectors  that  have  been  approved,  the  number  counted  for 
purposes  of  this  report  would  be  one  target,  not  four.  Alternatively,  if  two  targets  are  using  one 
selector  that  has  been  approved,  the  number  counted  would  be  two  targets. 
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Figure  17:  Table  of  CDR  Orders  and  Targets 


Call  Detail  Records  "CDRs"  -  Section  501(b)(2)(C) 

CY2016 

CY2017 

Total  number  of  orders  issued  pursuant  to  applications  under 

Section  501(b)(2)(C) 

40 

40 

Estimated  number  of  targets  of  such  orders 

42 

40 

5ee  50  U.S.C.  §§  1873(b)(6)  and  1873(b)(6)(A). 


The  estimated  number  of  Call  Detail  Records  received  from  providers.  This  metric  represents 
the  number  of  records  received  from  the  provider(s)  and  stored  in  NSA  repositories  (records 
that  fail  at  any  of  a  variety  of  validation  steps  are  not  included  in  this  number).  CDRs  covered  by 
§  501(b)(2)(C)  include  call  detail  records  created  before,  on,  or  after  the  date  of  the  application 
relating  to  an  authorized  investigation.  While  the  USA  FREEDOM  Act  directs  the  government  to 
provide  a  good  faith  estimate  of  "the  number  of  unique  identifiers  used  to  communicate 
information  collected  pursuant  to"  orders  issued  in  response  to  CDR  applications  (see 
50  U.S.C.  §  1873(b)(5)(B)),  the  statistic  below  does  not  reflect  the  number  of  unique  identifiers 
contained  within  the  call  detail  records  received  from  the  providers.  As  of  the  date  of  this 
report,  the  government  does  not  have  the  technical  ability  to  isolate  the  number  of  unique 
identifiers  within  records  received  from  the  providers.  As  explained  in  the  2016  NSA  public 
report  on  the  USA  FREEDOM  Act,  the  metric  provided  is  over-inclusive  because  the  government 
counts  each  record  separately  even  if  the  government  receives  the  some  record  multiple  times 
(whether  from  one  provider  or  multiple  providers).  Additionally,  this  metric  includes  duplicates 
of  unique  identifiers  -  i.e.,  because  the  government  lacks  the  technical  ability  to  isolate  unique 
identifiers,  the  statistic  counts  the  number  of  records  even  if  unique  identifiers  are  repeated. 
For  example,  if  one  unique  identifier  is  associated  with  multiple  calls  to  a  second  unique 
identifier,  it  will  be  counted  multiple  times.  Similarly,  if  two  different  providers  submit  records 
showing  the  same  two  unique  identifiers  in  contact,  then  those  would  also  be  counted.  This 
statistic  includes  records  that  were  received  from  the  providers  in  CY2017  for  all  orders  active 
for  any  portion  of  the  year,  which  includes  orders  that  the  FISC  approved  in  2016. 

Furthermore,  while  the  records  are  received  from  domestic  communications  service  providers, 
the  records  received  are  for  domestic  and  foreign  numbers.  More  information  on  how  NSA 
implements  this  authority  can  be  found  in  the  DCLPO  report,  in  particular  see  page  5  for  a 
description  and  illustration  of  the  USA  FREEDOM  Implementation  Architecture. 
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Figure  18:  Illustration  of  a  hop  scenario  and  counting 


Target  uses  Phone  A  which  is  the  FISC-approved  selector  in  the  FISC  order.  This  would  count 
as  1  order,  1  target,  7  unique  identifiers  (phones  A,  B,  C,  D,  E,  F,  G)  and,  assuming  500  calls 
between  parties,  6000  CDRs  (*produced  for  both  sides  of  a  call  event). 


Assume  an  NSA  intelligence  analyst  learns  that  phone  number  (Phone  A)  is  being  used  by  a 
suspected  international  terrorist  (target).  Phone  A  is  the  "specific  selection  term"  or  "selector" 
that  will  be  submitted  to  the  FISC  (or  the  Attorney  General  in  an  emergency)  for  approval  using 
the  "reasonable  articulable  suspicion"  (RAS)  standard.  Assume  that  one  provider  (provider  X) 
submits  a  record  showing  Phone  A  called  unique  identifier  Phone  B  -  what  is  referred  to  as  a 
"call  event."  This  is  the  'first  ho;'  In  turn,  assume  that  NSA  submits  the  "first-hop"  Phone  B  to 
the  provider  X,  and  finds  that  unique  identifier  was  used  to  call  another  unique  identifier  Phone 
D.  This  is  the  "second-hop."  If  the  unique  identifiers  call  one  another  multiple  times,  then 
multiple  CDRs  are  produced  and  duplication  occurs.  Additionally,  the  government  may  receive 
multiple  CDRs  for  a  single  call  event.  NSA  may  also  submit  the  specific  selection  Phone  A 
number  to  another  provider  (provider  Y)  who  may  have  CDRs  of  the  same  call  events. 

Not  all  CDRs  provided  to  the  government  will  be  domestic  numbers.  The  targeted  "specific 
selection  term"  could  be  a  foreign  number,  could  have  called  a  foreign  number  or  the  "first- 
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hop"  number  could  have  called  a  foreign  number;  thus,  these  CDRs  statistics  contain  both 
domestic  and  foreign  number  results. 


Figure  19:  Table  of  CDRs  Received  Arising  from  Such  Targets 


Call  Detail  Records  "CDRs"  -  Section  501(b)(2)(C) 

CY2016 

CY2017 

Estimated  number  of  call  detail  records  arising  from 
such  targets  that  NSA  received  from  providers  pursuant 
to  Section  501(b)(2)(C)  and  stored  in  its  repositories* 

151,230,968 

534,396,285 

*  While  the  statute  directs  the  government  to  count  the  unique  identifiers,  the  government  is 
not  technically  able  to  isolate  the  number  of  unique  identifiers;  thus,  this  number  includes 
duplicate  records.  Additionally,  the  number  of  records  contains  both  domestic  and  foreign 
numbers. 


D.  Statistics  -  Call  Detail  Record  Queries 

The  number  of  search  terms  associated  with  a  U.S.  person  used  to  query  the  CDR  data.  Each 
unique  query  is  counted  only  once.  The  same  term  queried  10  times  counts  as  one  query  term. 
A  single  query  with  20  terms  counts  as  20  query  terms. 


Figure  20:  Table  of  CDRs  -  U.S.  person  query  terms 


Call  Detail  Records  "CDRs"  -  Section  501(b)(2)(C) 

CY2016 

CY2017 

Estimated  number  of  search  terms  that  included 

information  concerning  a  U.S.  person  that  were  used  to 
query  any  database  of  call  detail  records  obtained 
through  the  use  of  such  orders* 

22,360 

31,196 

SeeSOU.S.C.  §  1873(b)(6)(C). 

*  Consistent  with  §  1873(d)(2)(A),  this  statistic  does  not  include  queries  that  are  conducted  by 
the  FBI. 
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National  Security  Letters  (NSLs) 

A.  National  Security  Letters 

In  addition  to  statistics  relating  to  FISA 
authorities,  we  are  reporting  information 
on  the  government's  use  of  National 
Security  Letters  (NSLs).  The  FBI  is 
statutorily  authorized  to  issue  NSLs  for 
specific  records  (as  specified  below)  only 
if  the  information  being  sought  is 
relevant  to  a  national  security 
investigation.  NSLs  may  be  issued  for 
four  commonly  used  types  of  records: 

1)  telephone  subscriber  information,  toll  records,  and  other  electronic  communication 
transactional  records,  see  18  U.S.C.  §  2709; 

2)  consumer-identifying  information  possessed  by  consumer  reporting  agencies  (names, 
addresses,  places  of  employment,  institutions  at  which  a  consumer  has  maintained  an 
account),  see  15  U.S.C.  §  1681u; 

3)  full  credit  reports,  see  15  U.S.C.  §  1681v  (only  for  counterterrorism,  not  for 
counterintelligence  investigations);  and 

4)  financial  records,  see  12  U.S.C.  §  3414. 

B.  Statistics  -  National  Security  Letters  and  Requests  of  Information 

Counting  NSLs.  Today  we  are  reporting  (1)  the  total  number  of  NSLs  issued  for  all  persons,  and 
(2)  the  total  number  of  requests  for  information  (ROI)  contained  within  those  NSLs.  When  a 
single  NSL  contains  multiple  ROIs,  each  is  considered  a  "request"  and  each  request  must  be 
relevant  to  the  same  pending  investigation.  For  example,  if  the  government  issued  one  NSL 
seeking  subscriber  information  from  one  provider  and  that  NSL  identified  three  e-mail 
addresses  for  the  provider  to  return  records,  this  would  count  as  one  NSL  issued  and  three 
ROIs. 


National  Security  Letters 

Not  authorized  by  FISA  but  by  other  statutes. 

Bulk  collection  is  prohibited,  however,  by  the  USA 
FREEDOM  Act. 

FBI  may  only  use  NSLs  if  the  information  sought  is 
relevant  to  international  counterterrorism  or 
counterintelligence  investigation. 
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•  The  Department  of  Justice's  Report  on  NSLs.  In  May  2018,  the  Department  of  Justice 
released  its  Annual  Foreign  Intelligence  Surveillance  Act  Report  to  Congress.  That  report, 
which  is  available  online,  provides  the  number  of  requests  made  for  certain  information 
concerning  different  U.S.  persons  pursuant  to  NSL  authorities  during  calendar  year 
2017.  The  Department  of  Justice's  report  provides  the  number  of  individuals  subject  to 
an  NSL  whereas  the  ODNI's  report  provides  the  number  of  NSLs  issued.  Because  one 
person  may  be  subject  to  more  than  one  NSL  in  an  annual  period,  the  number  of  NSLs 
issued  and  the  number  of  persons  subject  to  an  NSL  differs. 

Why  we  report  the  number  of  NSL  requests  instead  of  the  number  of  NSL  targets.  We  are 

reporting  the  annual  number  of  requests  for  multiple  reasons.  First,  the  FBI's  systems  are 
configured  to  comply  with  Congressional  reporting  requirements,  which  do  not  require  the  FBI 
to  track  the  number  of  individuals  or  organizations  that  are  the  subject  of  an  NSL.  Even  if  the 
FBI  systems  were  configured  differently,  it  would  still  be  difficult  to  identify  the  number  of 
specific  individuals  or  organizations  that  are  the  subjects  of  NSLs.  One  reason  for  this  is  that  the 
subscriber  information  returned  to  the  FBI  in  response  to  an  NSL  may  identify,  for  example,  one 
subscriber  for  three  accounts  or  it  may  identify  different  subscribers  for  each  account.  In  some 
cases  this  occurs  because  the  identification  information  provided  by  the  subscriber  to  the 
provider  may  not  be  true.  For  example,  a  subscriber  may  use  a  fictitious  name  or  alias  when 
creating  the  account.  Thus,  in  many  instances,  the  FBI  never  identifies  the  actual  subscriber  of  a 
facility.  In  other  cases,  this  occurs  because  individual  subscribers  may  identify  themselves 
differently  for  each  account  (e.g.,  inclusion  of  middle  name,  middle  initial,  etc.)  when  creating 
an  account. 

We  also  note  that  the  actual  number  of  individuals  or  organizations  that  are  the  subject  of  an 
NSL  is  different  than  the  number  of  NSL  requests.  The  FBI  often  issues  NSLs  under  different 
legal  authorities,  e.g.,  12  U.S.C.  §  3414(a)(5),  15  U.S.C.  §§  1681u(a)  and  (b),  15  U.S.C.  §  1681v, 
and  18  U.S.C.  §  2709,  for  the  same  individual  or  organization.  The  FBI  may  also  serve  multiple 
NSLs  for  an  individual  for  multiple  facilities  (e.g.,  multiple  e-mail  accounts,  landline  telephone 
numbers  and  cellular  phone  numbers).  The  number  of  requests,  consequently,  is  significantly 
larger  than  the  number  of  individuals  or  organizations  that  are  the  subjects  of  the  NSLs. 
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Figure  21a:  Table  of  NSLs  Issued  and  Requests  for  Information 
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Figure  21b:  Chart  of  NSLs  Issued  and  Requests  for  Information 
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UNCLASSIFIED 


Director  of  National  Intelligence 
Washington,  DC  20511 


MAY  0  4  2018 


The  Honorable  Richard  Burr 
Chairman 

Select  Committee  on  Intelligence 
United  States  Senate 


The  Honorable  Chuck  Grassley 
Chairman 

Committee  on  the  Judiciary 
United  States  Senate 


The  Honorable  Devin  Nunes 
Chairman 

Permanent  Select  Committee  on  Intelligence 
U.S.  House  of  Representatives 


The  Honorable  Robert  W.  Goodlatte 
Chairman 

Committee  on  the  Judiciary 
U.S.  House  of  Representatives 


Dear  Messrs.  Chairmen: 

Section  603(b)(2)(B)  of  the  Foreign  Intelligence  Surveillance  Act  (FISA),  as  amended  by 
the  Uniting  and  Strengthening  America  by  Fulfilling  Rights  and  Ensuring  Effective  Discipline 
Over  Monitoring  Act  of  2015,  (P.L.  1 14-23),  1 29  Stat.  268  (hereinafter  USA  FREEDOM  Act), 
requires  the  Director  of  National  Intelligence  (DNI)  to  make  publicly  available  for  the  preceding 
1 2-month  period  a  good  faith  estimate  of  the  number  of  queries  concerning  a  known  United 
States  person  of  unminimized  non-content  information  relating  to  electronic  communications  or 
wire  communications  obtained  through  acquisitions  authorized  under  Section  702  of  FISA, 
excluding  the  number  of  queries  containing  information  used  to  prevent  the  return  of  information 
concerning  a  United  States  person. 

If  the  DNI  concludes  that  this  good  faith  estimate  cannot  be  determined  accurately 
because  not  all  of  the  relevant  elements  of  the  Intelligence  Community  (IC)  are  able  to  provide 
this  good  faith  estimate,  then  FISA  requires  him  to  (i)  certify  that  conclusion  in  writing  to  the 
committees  identified  above;  (ii)  report  the  good  faith  estimate  for  those  relevant  elements  able 
to  provide  such  good  faith  estimate;  (iii)  explain  when  it  is  reasonably  anticipated  that  such  an 
estimate  will  be  able  to  be  determined  fully  and  accurately;  and  (iv)  make  such  certification 
publicly  available  on  an  Internet  website. 

I  conclude  that  the  good  faith  estimate  required  under  section  603(b)(2)(B)  of  FISA 
cannot  be  determined  accurately  because  not  all  of  the  relevant  elements  of  the  IC  are  able  to 
provide  this  good  faith  estimate.  Specifically,  the  Central  Intelligence  Agency  (CIA)  remained 
unable  to  provide  such  information  for  calendar  year  2017.  The  enclosed  report  includes  the 
good  faith  estimate  for  those  relevant  IC  elements  that  were  able  to  provide  such  good  faith 
estimate.  Based  on  the  information  provided  to  me  by  the  CIA,  I  reasonably  anticipate  that  such 
an  estimate  will  be  able  to  be  determined  fully  and  accurately  by  the  end  of  calendar  year  2018 
so  as  to  be  included  in  the  2019  report. 
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UNCLASSIFIED 


The  Honorable  Richard  Burr 
The  Honorable  Chuck  Grasslcy 
The  Honorable  Devin  Nunes 
The  Honorable  Robert  W.  Goodlatte 


If  you  have  any  questions  regarding  this  matter,  please  contact  the  Office  of  the  Director 
of  National  Intelligence  Office  of  legislative  Affairs  at  (703)  275-2474. 


Sincerely, 


Daniel  R.  Coats 


Enclosure: 

Stati.stical  Transparency  Report 

cc:  Executive  Secretary,  National  Security  Staff 

Director,  Central  Intelligence  Agency 
Under  Secretary  of  Defense  for  Intelligence 

Under  Secretary  for  Intelligence  and  Analysis,  Department  of  Homeland  Security 

Director,  National  Security  Agency 

Director,  National  Reconnaissance  Office 

Director,  Defense  Intelligence  Agency 

Director,  National  Geospatial-Intelligence  Agency 

Assistant  Secretary  for  Intelligence  and  Research,  Department  of  State 

Assistant  Secretary  for  Intelligence  and  Analysis,  Department  of  the  Treasury 

Executive  Assistance  Director,  Intelligence  Branch,  Federal  Bureau  of  Investigation 

Chief  of  Intelligence,  Senior  Officer,  Drug  Enforcement  Administration 

Director,  Office  of  Intelligence  and  Counterintelligence,  Department  of  Energy 

Deputy  Chief  of  Staff,  G2,  U.S.  Army 

Director  of  Intelligence,  U.S.  Marine  Corps 

Director  of  Naval  Intelligence,  N2  U.S.  Navy 

Deputy  Chief  of  Staff  for  Intelligence,  Surveillance  and  Reconnaissance,  A2,  U.S.  Air 


Force 


Deputy  Chief  of  Staff  for  Intelligence  and  Criminal  Investigations,  U.S.  Coast  Guard 
Assistant  Attorney  General  for  National  Security,  Department  of  Justice 
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DECLARATION  OF  SCOTT  BRADNER 

Wikimedia  Foundation  v.  NSA 
No.  15-CV-0062-TSE  (D.  Md.) 
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IN  THE  UNITED  STATES  DISTRICT  COURT  FOR  THE 
DISTRICT  OF  MARYLAND 

WIKIMEDIA  FOUNDATION,  INC. 

Plaintiff, 

V. 

NATIONAL  SECURITY  AGENCY,  et  al. 

Defendants. 

WIKIMEDIA  FOUNDATION,  INC.’S  RESPONSES  AND  OBJECTIONS  TO 
NATIONAL  SECURITY  AGENCY’S  FIRST  SET  OF  INTERROGATORIES 

Propounding  Party:  National  Security  Agency 

Responding  Party:  Wikimedia  Foundation,  Inc. 

Set  Number:  One 

Pursuant  to  Federal  Rule  of  Civil  Proeedure  33,  Plaintiff  Wikimedia  Foundation,  Ine. 
(“Plaintiff’  or  “Wikimedia”)  responds  as  follows  to  Defendant  National  Seeurity  Ageney’s 
(“Defendanf  ’  or  “NSA”)  (eolleetively  with  Plaintiff,  the  “Parties”)  First  Set  of  Interrogatories  (the 
“Interrogatories”): 

I.  General  Responses. 

1.  Plaintiffs  response  to  Defendant’s  Interrogatories  is  made  to  the  best  of  Plaintiff  s 

present  knowledge,  information,  and  belief.  Diseovery  in  this  aetion  is  ongoing,  and  Plaintiffs 
responses  may  be  substantially  altered  by  further  investigation,  ineluding  further  review  of 
Plaintiffs  own  doeuments,  as  well  as  the  review  of  doeuments  produeed  by  Defendant,  whieh 
Plaintiff  has  just  begun  to  reeeive.  Said  response  is  at  all  times  subject  to  such  additional  or 
different  information  that  discovery  or  further  investigation  may  disclose  and,  while  based  on  the 
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present  state  of  Plaintiffs  reeollection,  is  subjeet  to  such  refreshing  of  recollection,  and  such 
additional  knowledge  of  facts,  as  may  result  from  Plaintiffs  further  discovery  or  investigation. 

2.  Plaintiff  reserves  the  right  to  make  any  use  of,  or  to  introduce  at  any  hearing  and  at 
trial,  information  and/or  documents  responsive  to  Defendant’s  Interrogatories  but  discovered 
subsequent  to  the  date  of  this  response,  including,  but  not  limited  to,  any  such  information  or 
documents  obtained  in  discovery  herein. 

3.  To  the  extent  that  Plaintiff  responds  to  Defendant’s  Interrogatories  by  stating  that 
Plaintiff  will  provide  information  and/or  documents  that  Plaintiff  deems  to  embody  material  that 
is  private,  business  confidential,  proprietary,  trade  secret,  or  otherwise  protected  from  disclosure 
pursuant  to  Federal  Rule  of  Civil  Procedure  26(c)(7),  Federal  Rule  of  Evidence  501,  or  other 
applicable  law.  Plaintiff  will  do  so  only  pursuant  to  the  Parties’  Stipulated  Protective  Order  (ECF 
No.  120). 

4.  Plaintiff  reserves  all  objections  or  other  questions  as  to  the  competency,  relevance, 
materiality,  privilege,  or  admissibility  as  evidence  in  any  subsequent  proceeding  in  or  trial  of  this 
or  any  other  action  for  any  purpose  whatsoever  of  Plaintiff  s  responses  herein  and  any  document 
or  thing  identified  or  provided  in  response  to  Defendant’s  Interrogatories. 

5.  Plaintiffs  responses  will  be  subject  to  and  limited  by  any  agreements  the  Parties 
reach  concerning  the  scope  of  discovery. 

6.  Plaintiff  reserves  the  right  to  object  on  any  ground  at  any  time  to  such  other  or 
supplemental  interrogatories  as  Defendant  may  at  any  time  propound  involving  or  relating  to  the 
subject  matter  of  these  Interrogatories. 

II.  General  Objections. 

Plaintiff  makes  the  following  general  objections,  whether  or  not  separately  set  forth  in 
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response  to  each  Interrogatory,  to  each  instruction,  definition,  and  Interrogatory  made  in 
Defendant’s  Interrogatories: 

1.  Plaintiff  objects  to  the  Interrogatories  in  their  entirety  insofar  as  any  such 
instruction,  definition,  or  Interrogatory  seeks  information  or  production  of  documents  protected 
by  the  attorney-client  privilege  or  the  work  product  doctrine.  Fed.  R.  Civ.  Proc.  26(b)(1).  Such 
information  or  documents  shall  not  be  provided  in  response  to  Defendant’s  Interrogatories  and  any 
inadvertent  disclosure  or  production  thereof  shall  not  be  deemed  a  waiver  of  any  privilege  with 
respect  to  such  information  or  documents  or  of  any  work  product  immunity  which  may  attach 
thereto.  Fed.  R.  Civ.  Proc.  26(b)(5)(B). 

2.  Plaintiff  objects  to  the  Interrogatories  in  their  entirety  to  the  extent  any  such 
instruction,  definition,  or  Interrogatory  seeks  identification  of  documents,  witnesses,  or 
information  that  Defendant  has  withheld  from  Plaintiff  Fed.  R.  Civ.  Proc.  26(b)(1),  (2). 

3.  Plaintiff  objects  to  the  Interrogatories  in  their  entirety  to  the  extent  any  such 
Interrogatory  requires  Plaintiff  to  identify  potentially  thousands  of  pages  of  documents,  not  all  of 
which  have  been  or  can  be  located  and  reviewed  by  counsel  within  the  time  period  allowed  for  this 
response  or  within  a  reasonable  time.  Accordingly,  said  Interrogatories  would  subject  Plaintiff  to 
unreasonable  and  undue  annoyance,  oppression,  burden  and  expense. 

4.  Plaintiff  objects  to  any  Interrogatories  that  exceed  the  scope  of  jurisdictional 
discovery  as  defined  by  Defendants,  see  ECF  No.  1 16  at  4,  and  ordered  by  the  Court. 

5.  Plaintiff  objects  to  the  Interrogatories  in  their  entirety  to  the  extent  any  such 
instruction,  definition,  or  Interrogatory  seeks  information  that  is  available  through  or  from  public 
sources  or  records,  or  that  are  otherwise  equally  available  to  Defendant,  on  the  ground  that  such 
instructions,  definitions,  and/or  Interrogatories  unreasonably  subject  Plaintiff  to  undue  annoyance. 
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oppression,  burden,  and  expense.  Fed.  R.  Civ.  Proe.  26(b)(1),  (2). 

6.  Plaintiff  objeets  to  the  Interrogatories  in  their  entirety  to  the  extent  any  sueh 
instruetion,  definition,  or  Interrogatory  purport  to  impose  obligations  that  are  greater  or  more 
burdensome  than  or  eontradiet  those  imposed  by  the  applieable  Federal  and  loeal  rules.  See  Fed. 
R.  Civ.  Proe.  26,  33. 

7.  Plaintiff  objeets  to  the  Interrogatories  in  their  entirety  as  the  Interrogatories  eontain 
more  than  the  “25  written  interrogatories,  ineluding  all  diserete  subparts,”  permitted  by  the  Federal 
Rules  of  Civil  Proeedure,  Rule  33(a)(1),  and  Defendant  has  not  sought  leave  to  serve  additional 
interrogatories. 

8.  Plaintiff  objeets  to  the  Interrogatories  in  their  entirety  to  the  extent  any  sueh 
instruetion,  definition,  or  Interrogatory  seeks  doeuments  or  information  no  longer  in  existenee  or 
not  eurrently  in  Plaintiff’s  possession,  eustody,  or  eontrol,  or  to  the  extent  they  refer  to  persons, 
entities,  or  events  not  known  to  Plaintiff  or  eontrolled  by  Plaintiff,  on  the  grounds  that  sueh 
definitions  or  Interrogatories  are  overly  broad,  seek  to  require  more  of  Plaintiff  than  any  obligation 
imposed  by  law,  would  subjeet  Plaintiff  to  unreasonable  and  undue  annoyanee,  oppression, 
burden,  and  expense,  and  would  seek  to  impose  upon  Plaintiff  an  obligation  to  investigate, 
diseover,  or  produee  information  or  materials  from  third  parties  or  otherwise  that  are  aeeessible  to 
Defendant  or  readily  obtainable  from  publie  or  other  sourees.  Fed.  R.  Civ.  Proe.  26(b)(1),  (2). 

9.  Plaintiff  objeets  to  the  Interrogatories  in  their  entirety  to  the  extent  any  sueh 
instruetion,  definition,  or  Interrogatory  seeks  information  or  produetion  of  doeuments  proteeted 
from  diselosure  by  any  right  to  privaey  or  any  other  applieable  privilege  or  proteetion,  ineluding 
the  right  to  eonfidentiality  or  privaey  of  third  parties,  any  right  of  eonfidentiality  provided  for  by 
Plaintiffs  eontraets  or  agreements  with  sueh  third  parties,  or  by  Plaintiffs  obligations  under 
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applicable  law  or  contract  to  protect  such  confidential  information.  Plaintiff  reserves  the  right  to 
withhold  any  responsive  information  or  documents  governed  by  a  third-party  confidentiality 
agreement  until  such  time  as  the  appropriate  notice  can  be  given  or  the  appropriate  permissions 
can  be  obtained.  Plaintiff  also  objects  generally  to  all  instructions,  definitions,  or  Interrogatories 
to  the  extent  they  seek  disclosure  of  trade  secrets  and  other  confidential  research  or  analyses, 
development,  or  commercial  information  of  Plaintiff  or  any  third  party. 

10.  Plaintiff  objects  to  the  Interrogatories  in  their  entirety  to  the  extent  any  such 
instruction,  definition,  or  Interrogatory  is  overbroad  and  unduly  burdensome,  particularly  to  the 
extent  they  seek  “all,”  “each,”  or  “any”  documents,  witnesses  or  facts  relating  to  various  subject 
matters.  Fed.  R.  Civ.  Proc.  26(b)(1),  (2).  To  the  extent  Plaintiff  responds  to  such  Interrogatories, 
Plaintiff  will  use  reasonable  diligence  to  identify  responsive  documents,  witnesses  or  facts  in  its 
possession,  custody,  or  control,  based  on  its  present  knowledge,  information,  and  belief 

11.  Plaintiff  objects  to  the  Interrogatories  in  their  entirety  to  the  extent  any  such 
instruction,  definition,  or  Interrogatory  seeks  expert  discovery  prematurely. 

12.  Plaintiff  objects  to  any  contention  Interrogatories  in  their  entirety  as  premature. 
Plaintiff  will  provide  its  response  prior  to  the  close  of  fact  discovery. 

13.  Plaintiff  objects  to  the  Interrogatories  in  their  entirety  to  the  extent  any  such 
instruction,  definition,  or  Interrogatory  purports  to  require  Plaintiff  to  restore  and/or  search  data 
sources  that  are  not  reasonably  accessible  on  the  grounds  that  such  definitions  and  Interrogatories 
would  subject  Plaintiff  to  undue  burden  and  expense.  Fed.  R.  Civ.  Proc.  26(b)(1),  (2). 

III.  Definitional  Objections. 

1.  Plaintiff  objects  to  definition  number  one  (1)  to  the  extent  it  defines  “Plaintiff’  and 
“Wikimedia”  to  include  Plaintiffs  “parent,  subsidiary,  and  affiliated  organizations,  and  all  persons 
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acting  on  their  behalf,  ineluding  officials,  agents,  employees,  attorneys,  and  consultants.”  Said 
definition  is  overly  broad,  seeks  irrelevant  information  not  calculated  to  lead  to  the  discovery  of 
admissible  evidence,  seeks  information  outside  of  Plaintiff  s  possession,  custody,  or  control,  and 
would  subject  Plaintiff  to  unreasonable  and  undue  annoyanee,  oppression,  burden  and  expense. 
Said  definition  is  also  vague  and  ambiguous  in  that  it  cannot  be  determined  what  is  meant  by  the 
terms  “affiliated  organizations”  and  “all  persons  aeting  on  their  behalf”  Plaintiff  shall  construe 
“Plaintiff’  and  “Wikimedia”  to  mean  Wikimedia,  and  its  present  officers,  directors,  agents,  and 
employees. 

2.  Plaintiff  objeets  to  definition  number  four  (4)  and  to  each  Interrogatory  that 
purports  to  require  Plaintiff  to  “state  the  basis  of,”  “stating  the  basis  of,”  “state  on  what  basis,”  or 
otherwise  “state  with  particularity”  or  “identify”  “all”  facts,  documents,  or  persons  whose 
testimony  support  or  dispute  any  given  factual  assertion,  on  the  ground  that  any  response  thereto 
would  require  subjective  judgment  on  the  part  of  Plaintiff  and  its  attorneys,  and  would  further 
require  disclosure  of  a  eonelusion  or  opinion  of  counsel  in  violation  of  the  attorney  work  produet 
doetrine  and/or  attorney-client  privilege.  Plaintiff  further  objects  that  this  definition  and  all 
requests  to  identify  doeuments  in  the  Interrogatories  are  premature  at  this  early  stage  of  the 
litigation,  would  subject  Plaintiff  to  unreasonable  and  undue  annoyanee,  oppression,  burden,  and 
expense,  and  would  impose  an  obligation  to  provide  information  greater  than  that  required  by  the 
Federal  Rules  of  Civil  Proeedure. 

3.  Plaintiff  objeets  to  definition  number  five  (5)  as  unduly  burdensome  in  that  it 
purports  to  require  Plaintiff  to  “identify”  eaeh  “natural  person”  by  providing  information  including 
“her  most  current  home  and  business  addresses,  telephone  numbers,  and  e-mail  addresses,  the 
name  of  her  current  employer,  and  her  title.” 
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4,  Plaintiff  objects  to  definition  number  six  (6)  as  unduly  burdensome  in  that  it 
purports  to  require  Plaintiff  to  “identify”  an  “entity  that  is  not  a  natural  person”  by  providing 
information  including  “its  telephone  number  and  e-mail  address,  and  the  full  names,  business 
addresses,  telephone  numbers,  and  e-mail  addresses  of  both  its  chief  executive  officer  and  an  agent 
designated  by  it  to  receive  service  of  process.” 

5.  Plaintiff  objects  to  definition  number  seven  (7)  as  unduly  burdensome  in  that  it 
purports  to  require  Plaintiff  to  “identify”  documents  by  providing  “(a)  the  nature  of  the  document 
{i.e,  letter,  memorandum,  spreadsheet,  database,  etc.);  (b)  its  date;  (c)  its  author(s)  (including 
title(s)  or  position(s));  (d)  its  recipient/ s)  (including  title(s)  or  position(s));  (e)  its  number  of  pages 
or  size;  and  (f)  its  subject  matter,”  or  by  providing  information  in  accordance  with  Defendant’s 
“Specifications  for  Production  of  ESI  and  Digitized  (‘Scanned’)  Images  attached  to  Defendant 
National  Security  Agency’s  First  Set  of  Requests  for  Production.”  Plaintiff  further  objects  that 
this  definition  and  all  requests  to  identify  documents  in  the  Interrogatories  are  premature  at  this 
early  stage  of  the  litigation,  would  subject  Plaintiff  to  unreasonable  and  undue  annoyance, 
oppression,  burden,  and  expense,  and  would  impose  an  obligation  to  provide  information  greater 
than  that  required  by  the  Federal  Rules  of  Civil  Procedure. 

IV.  Instructional  Objections 

1.  Plaintiff  objects  to  instruction  number  one  (1)  to  the  extent  it  purports  to  request 
“knowledge  or  information”  from  Wikimedia’s  “parent,  subsidiary,  or  affiliated  organizations,  and 
their  officials,  agents,  employees,  attorneys,  consultants,  and  any  other  person  acting  on  their 
behalf.”  Said  request  is  overly  broad,  seeks  irrelevant  information  not  calculated  to  lead  to  the 
discovery  of  admissible  evidence,  seeks  information  outside  Plaintiffs  possession,  custody,  or 
control,  and  would  subject  Plaintiff  to  unreasonable  and  undue  annoyance,  oppression,  burden  and 


7. 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1201  of  1298 


expense.  Moreover,  said  request  is  vague  and  ambiguous  in  that  it  eannot  be  determined  what  is 
meant  by  the  term  “affiliated  organizations”  and  “any  other  person  aeting  on  their  behalf.”  Where 
an  Interrogatory  requests  knowledge  or  information  of  Plaintiff,  Plaintiff  shall  eonstrue  sueh 
request  to  mean  knowledge  or  information  from  Wikimedia,  and  its  present  offieers,  direetors, 
agents,  and  employees. 

2,  Plaintiff  objeets  to  instruetion  number  three  (3)  as  unduly  burdensome  and 
imposing  an  obligation  to  provide  information  greater  than  that  required  by  the  Federal  Rules  of 
Civil  Proeedure  to  the  extent  it  purports  to  require  Plaintiff  to  “identify  eaeh  person  known  by 
Plaintiff  to  have  such  knowledge,  and  in  each  instance  where  Plaintiff  avers  insufficient  knowledge 
or  information  as  a  grounds  for  not  providing  information  or  for  providing  only  a  portion  of  the 
information  requested,  set  forth  a  description  of  the  efforts  made  to  locate  information  needed  to 
answer  the  interrogatory.” 

3,  Plaintiff  objects  to  instruction  number  four  (4)  to  the  extent  it  seeks  to  require  it  to 
identify  anything  other  than  the  specific  claim  of  privilege  or  work  product  being  made  and  the 
basis  for  such  claim,  and  to  the  extent  it  seeks  to  require  any  information  not  specified  in  Discovery 
Guideline  10,  on  the  grounds  that  the  additional  information  sought  by  Defendant  would  subject 
Plaintiff  to  unreasonable  and  undue  annoyance,  oppression,  burden,  and  expense,  and  constitutes 
information  protected  from  discovery  by  privilege  and  as  work  product.  Plaintiff  is  willing  to 
discuss  acceptable  reciprocal  obligations  for  disclosure  of  information  withheld  on  the  basis  of 
attorney-client  privilege  or  attorney  work-product. 

4,  Plaintiff  objects  to  instruction  number  five  (5)  to  the  extent  it  defines  “the  time 
period  for  which  each  interrogatory  seeks  a  response”  as  “the  period  from  July  10,  2008  (the  date 
of  enactment  of  the  FISA  Amendments  Act  of  2008,  Pub.  L.  II0-26I,  I2I  Stat.  522)  until  the  date 
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of  Plaintiff  s  response.”  This  definition  is  overly  broad,  seeks  irrelevant  information  not  ealculated 
to  lead  to  the  diseovery  of  admissible  evidenee,  and  would  subjeet  Plaintiff  to  unreasonable  and 
undue  annoyanee,  oppression,  burden,  and  expense.  Where  appropriate.  Plaintiff  has  defined  the 
speeifie  time  period  eneompassed  by  speeifie  responses. 

5.  Plaintiff  objeets  to  instruction  number  six  (6)  that  the  Interrogatories  are  continuing, 
to  the  extent  said  instruction  seeks  unilaterally  to  impose  an  obligation  to  provide  supplemental 
information  greater  than  that  required  by  Federal  Rule  of  Civil  Procedure  26(e)  and  would  subject 
Plaintiff  to  unreasonable  and  undue  annoyance,  oppression,  burden,  and  expense.  Plaintiff  will 
comply  with  the  requirements  of  the  Federal  Rules  of  Civil  Procedure  and  is  willing  to  discuss 
mutually  acceptable  reciprocal  obligations  for  continuing  discovery. 

V.  Specific  Objections  And  Responses  To  Interrogatories, 

Without  waiving  or  limiting  in  any  manner  any  of  the  foregoing  General  Objections, 
Definitional  Objections,  or  Instructional  Objections,  but  rather  incorporating  them  into  each  of  the 
following  responses  to  the  extent  applicable.  Plaintiff  responds  to  the  specific  Interrogatories  in 
Defendant’s  Interrogatories  as  follows: 

ALLEGED  NSA  INTERCEPTION  OF  SUBSTANTIALLY  ALL  INTERNATIONAL, 
TEXT-BASED,  INTERNET  COMMUNICATIONS 

Interrogatory  No,  1: 

Notwithstanding  the  holding  of  the  Court  of  Appeals  in  this  case  that  “Plaintiffs  lack 
standing  to  sue  . . .  under  the  Dragnet  Allegation  because  they  can’t  plausibly  show  that  the  NSA 
is  intercepting  their  communications  via  a  dragnet,”  Wikimedia  Found,  v.  NSA,  857  F.3d  193,  216 
(4th  Cir.  2017),  does  Plaintiff  still  contend,  for  the  purpose  of  establishing  jurisdiction,  that  NSA 
Upstream  surveillance  involves  the  interception,  copying,  and  review  (as  those  terms  are  used  in 
paragraph  56  of  the  Amended  Complaint)  of  all  or  substantially  all  international  Internet  text-based 
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communications? 

Response  to  Interrogatory  No.  1: 

In  addition  to  the  General  Objections  above  whieh  are  ineorporated  herein,  Plaintiff  also 
objeets  that  this  Interrogatory  seeks  a  statement  of  Plaintiff  s  legal  strategy  or  information  that  is 
protected  by  the  attorney-elient  privilege  or  the  attorney  work  product  doctrine.  Plaintiff  further 
objeets  that  this  Interrogatory  is  a  eontention  Interrogatory  that  is  premature  at  this  stage  in  the 
litigation.  Plaintiff  therefore  speeifieally  reserves  the  right  to  supplement  and  amend  its  response 
based  on  further  investigation  and  diseovery. 

Subjeet  to  and  without  waiving  any  of  these  General  or  Specifie  Objeetions,  Plaintiff 
responds  as  follows:  Yes. 

Interrogatory  No.  2: 

Unless  Plaintiffs  response  to  Interrogatory  No.  1,  above,  is  an  unequivoeal  “no,”  then 
please  state  the  basis  of  Plaintiffs  eontention  that  NS  A  Upstream  surveillanee  involves  the 
intereeption,  eopying,  and  review  of  all  or  substantially  all  international  Internet  text-based 
communieations,  ineluding,  but  not  limited  to,  the  eontentions  that  “Upstream  surveillanee  is 
intended  to  enable  the  eomprehensive  monitoring  of  international  internet  traffie,”  see  Amended 
Complaint  ][  48;  that  “the  NSA  is  temporarily  eopying  and  then  sifting  through  the  eontents  of 
what  is  apparently  most  e  mails  and  other  text-based  eommunieations  that  eross  the  border,”  see 
id.  T1  69;  that  “it  would  be  diffieult  to  systematieally  seareh  the  eontents  of  the  eommunieations 
without  first  gathering  nearly  all  eross-border  text-based  data,”  see  PL’s  0pp.  to  Defs.’  MTD  at 
18-19;  and  that  the  U.S.  Government  “has  aeknowledged  ...  that  the  NSA  ...  examines  the  full 
eontents  of  essentially  everyone’s  eommunieations  to  determine  whether  they  include  referenees 
to  the  NSA’s  seareh  terms,”  see  id.  at  10. 
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Response  to  Interrogatory  No,  2: 

In  addition  to  the  General  Objeetions  above  whieh  are  ineorporated  herein,  Plaintiff  further 
objects  that  this  Interrogatory  is  a  contention  Interrogatory  that  is  premature  at  this  stage  in  the 
litigation.  Plaintiff  further  submits  that  these  matters  may  be  the  subject  of  expert  testimony,  as  to 
which  Plaintiff  will  provide  discovery  at  the  appropriate  time. 

Plaintiff  therefore  specifically  reserves  the  right  to  supplement  and  amend  its  response 
based  on  further  investigation  and  discovery.  Plaintiff  additionally  objects  that  this  Interrogatory 
is  improperly  compound  in  that  it  contains  multiple  subparts. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

The  bases  for  Plaintiffs  contention  include  the  following: 

•  Basic  principles  underlying  how  Internet  communications  are  transmitted  and  how 
surveillance  on  a  packet-switched  network  operates. 

•  Privacy  &  Civil  Liberties  Oversight  Board,  Report  on  the  Surveillance  Program 
Operated  Pursuant  to  Section  702  of  FISA  (2014)  (“PCLOB  Report”),  including  pages  7-10,  12- 
13,  22,  30-41  &  n.l57,  79,  111  n.476,  120-22,  125,  143,  and  official  government  sources 
concerning  Upstream  surveillance  cited  therein. 

•  [Redacted],  No.  [Redacted],  2011  WL  10945618  (FISC  Oct.  3,  2011) 

•  50  U.S.C.  §§  1801,  1881a. 

•  David  S.  Kris  &  J.  Douglas  Wilson,  National  Security  Investigations  and  Prosecutions 
§  17.5  (July  2015) 

•  Julia  Angwin  &  Jeff  Larson,  New  Snowden  Documents  Reveal  Secret  Memos 
Expanding  Spying,  ProPublica  (June  4,  2015)  (and  associated  documents) 
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•  Julia  Angwin  et  al.,  AT&T  Helped  U.S.  Spy  on  Internet  on  Vast  Scale,  N.Y.  Times, 
Aug.  15,  2015  (and  associated  documents) 

•  Julia  Angwin  et  al.,  NSA  Spying  Relies  on  AT&T’s  ‘Extreme  Willingness  to  Help’, 
ProPublica,  Aug.  15,  2015  (and  associated  documents) 

•  Jeff  Larson  et  al.,  A  Trail  of  Evidence  Leading  to  AT&T’s  Partnership  with  the  NSA, 
ProPublica,  Aug.  15,  2015  (and  associated  documents) 

•  PCLOB,  Public  Hearing  Regarding  the  Surveillance  Program  Operated  Pursuant  to 
Section  702  of  the  Foreign  Intelligence  Surveillance  Act  26:15-18  (Mar.  19,  2014)  (statement  of 
Robert  Litt,  General  Counsel,  ODNI) 

•  Charlie  Savage,  Power  Wars  (2015) 

Additionally,  Plaintiffs  contention  is  based  on  the  principles  of  Internet  communication 
and  the  technical  necessities  of  the  inspection  of  Internet  communications  in  transit. 

For  example,  Internet  communications  in  transit  are  split  into  packets.  Where  an 
eavesdropper  is  attempting  to  determine  whether  the  contents  of  a  particular  communication  in 
transit  on  the  Internet  contain  a  particular  piece  of  information,  the  eavesdropper  generally  must 
reassemble  the  packets  constituting  the  communication  and  then  scan  the  reassembled 
communication.  Reassembling  Internet  packets  requires  the  temporary  copying  (or  “caching”)  of 
those  packets  until  all  packets  needed  for  the  reassembly  have  arrived. 

Additionally,  Upstream  surveillance  involves  the  retention  of  communications  that  contain 
targeted  selectors.  To  retain  a  communication  in  transit,  an  eavesdropper  must  copy  and 
reassemble  the  packets  constituting  the  communication.  But  because  an  eavesdropper  cannot 
know  in  advance  which  packets  in  transit  are  part  of  a  communication  containing  a  targeted 
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selector,  the  eavesdropper  must  create  a  temporary  copy  of  all  packets  that  might  be  a  part  of  such 
a  communication. 

The  fact  that  all  or  substantially  all  international  Internet  text-based  communications  are 
subject  to  Upstream  surveillance  follows  necessarily  from  the  information  the  government  has 
officially  disclosed,  and  it  is  corroborated  by  independent  news  reports.  For  Upstream  surveillance 
to  serve  the  purposes  the  government  has  said  it  serves,  the  NS  A  must  be  comprehensively 
monitoring  text-based  communications  originating  or  terminating  in  the  United  States.  This  is  the 
only  way  for  the  NSA  to  reliably  obtain  communications  to,  from,  and  about  its  thousands  of 
targets  around  the  world,  because  those  communications  travel  along  paths  in  and  out  of  the 
country  that  are  unpredictable  and  change  over  time.  Moreover,  the  structure  of  the  Internet 
backbone  facilitates  such  comprehensive  surveillance.  Because  international  communications  are 
channeled  through  a  small  number  of  Internet  chokepoints — and  because  the  NSA’s  own 
documents  show  that  it  is  conducting  Upstream  surveillance  at  many  of  those  chokepoints — it  is 
straightforward  for  the  government  to  conduct  the  comprehensive  surveillance  necessary  for 
Upstream  to  function  as  described. 

The  government’s  descriptions  of  Upstream  surveillance  make  clear  that  the  government 
is  interested  in  obtaining,  with  a  high  degree  of  confidence,  all  international  communications  to, 
from,  and  about  its  targets.  For  example,  the  Privacy  and  Civil  Liberties  Oversight  Board  has 
described  the  use  of  Upstream  surveillance  to  collect  “about”  communications  as  “an  inevitable 
byproduct  of  the  government’s  efforts  to  comprehensively  acquire  communications  that  are  sent 
to  or  from  its  targets.”  PCLOB  Report  10  (emphasis  added).  And  it  has  said  about  Upstream 
surveillance  more  generally  that  this  method’s  “success  . .  .  depends  on  collection  devices  that  can 
reliably  acquire  data  packets  associated  with  the  proper  communications.”  Id.  at  143  (emphasis 


13. 


Case  l:15-cv-00662-TSE  Document  168-4  Filed  12/18/18  Page  1207  of  1298 


added). 

Because  the  routing  of  Internet  traffic  is  unpredictable,  however,  the  government  can  only 
“comprehensively”  and  “reliably”  obtain  communications  to,  from,  and  about  its  thousands  of 
targets  by  conducting  its  surveillance  on  the  different  routes  by  which  Internet  communications 
enter  and  leave  the  country,  and  by  examining  substantially  all  international  communications  that 
travel  those  various  routes. 

The  path  that  an  Internet  communication  takes  is  inherently  unpredictable.  Internet 
communications  are  routed  around  the  globe  based  on  a  complex  set  of  rules  and  relationships  that 
are  applied  dynamically,  based  on  network  conditions  at  any  given  moment.  These  network 
conditions  change  frequently,  and  so  one  cannot  know  in  advance  which  path  a  particular 
communication  will  travel.  Indeed,  even  the  communications  between  two  individuals  in  a  single 
conversation  (such  as  an  Internet  chat  or  email  exchange)  may  take  entirely  different  routes  across 
the  Internet  backbone,  even  though  the  end-points  are  the  same.  For  example,  if  an  NS  A  target  is 
having  an  Internet  chat  conversation  with  someone  in  the  United  States,  the  communications  from 
the  target  will  frequently  follow  a  different  path  than  those  to  the  target.  And,  of  course,  a  target’s 
location  may  vary  over  time.  For  all  these  reasons,  a  target’s  communications  may  traverse  one 
Internet  circuit  at  one  moment,  but  a  different  one  later. 

The  fact  that  the  NSA  had,  at  last  public  count,  106,469  surveillance  targets  (some  of  which 
are  groups  with  perhaps  hundreds  or  even  thousands  of  members)  only  reinforces  the  conclusion 
that  Upstream  surveillance  of  international  text-based  communications  must  be  comprehensive. 
See  ODNI,  Statistical  Transparency  Report  Regarding  the  Use  of  National  Security  Authorities  for 
Calendar  Year  2016  (Apr.  2017), 

https://icontherecord.tumblr.com/transparency/odni_transparencyreport_cy20 16.  The 
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communications  of  so  many  targets  scattered  around  the  world  will  travel  many  different  routes 
across  the  Internet  baekbone,  based  on  the  loeations  of  those  various  targets,  their  individual 
movements  over  time,  and  changes  in  network  conditions.  These  communieations  will  be 
intermingled  with  those  of  the  general  population  in  the  flow  of  Internet  traffie.  An  intelligenee 
agency  that  seeks  to  reliably  intereept  communications  to,  from,  or  about  its  targets,  eould  do  so 
only  by  searching  substantially  all  text-based  communications  entering  or  leaving  the  country. 

This  allegation  is  based  on  the  government’s  official  disclosures  and  on  necessary 
inferences  from  those  diselosures,  but  it  is  also  eorroborated  by  news  accounts.  ANew  York  Times 
report  from  August  2013  states,  based  on  a  review  of  NSA  documents  and  interviews  with  senior 
intelligence  officials,  that  “the  N.S.A.  is  temporarily  copying  and  then  sifting  through  the  contents 
of  what  is  apparently  most  e-mails  and  other  text-based  communications  that  cross  the  border.” 
Charlie  Savage,  N.S.A.  Said  to  Search  Content  of  Messages  to  and from  U.S.,  N.Y.  Times,  Aug.  8, 
2013,  http://nyti.ms/lElnlsi.  The  same  New  York  Times  report  also  explains  why  the  NSA’s 
Upstream  surveillance  is  so  far-reaching: 

“Computer  scientists  said  that  it  would  be  diffieult  to  systematieally  seareh  the  contents  of 
the  communications  without  first  gathering  nearly  all  eross-border  text-based  data;  fiber¬ 
optic  networks  work  by  breaking  messages  into  tiny  packets  that  flow  at  the  speed  of  light 
over  different  pathways  to  their  shared  destination,  so  they  would  need  to  be  captured  and 
reassembled.” 

Id.;  see  also  Charlie  Savage,  Power  Wars  207-1 1  (2015). 

Not  only  does  the  NSA  have  an  overriding  ineentive  to  copy  and  review  substantially  all 
international  Internet  eommunications,  but  the  Internet  backbone  is  structured  in  a  way  that  enables 
it  to  do  so. 
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The  Internet  baekbone  funnels  almost  all  Internet  communieations  entering  and  leaving  the 
eountry  through  a  limited  number  of  ehokepoints.  The  Internet  baekbone  ineludes  a  relatively 
small  number  of  international  submarine  eables  (and  a  limited  number  of  terrestrial  eables)  that 
transport  Internet  traffic  into  and  out  of  the  United  States.  Because  there  are  relatively  few  high- 
capacity  cables  carrying  international  Internet  communications,  there  are  correspondingly  few 
ehokepoints — i.  e. ,  junctions  through  which  all  international  Internet  communications  must  pass  en 
route  to  their  destinations.  By  installing  its  surveillance  equipment  at  the  small  number  of 
backbone  ehokepoints,  the  NSA  is  able  to  monitor  substantially  all  text-based  communications 
entering  or  leaving  the  United  States.  And  the  government  has  acknowledged  that  it  conducts 
Upstream  surveillance  at  international  links  and  on  the  Internet  backbone.  [Redacted],  2011  WL 
I09456I8,  at  *15;  PCLOB  Report  36-37. 

NSA  documents  published  in  the  press  show  that  the  NSA  has  installed  surveillance 
equipment  at  many  major  ehokepoints  on  the  Internet  backbone.  One  of  these  NSA  documents 
states  that  the  NSA  has  established  interception  capabilities  on  “many  of  the  ehokepoints  operated 
by  U.S.  providers  through  which  international  communications  enter  and  leave  the  United  States.” 
See  Plaintiffs  First  Amended  Complaint  ][  69.  Another  shows  that  just  one  of  those  participating 
providers  has  facilitated  Upstream  surveillance  at  seven  major  international  ehokepoints  in  the 
United  States.  Id.  T1  68.  Additional  reporting  states  that  the  NSA  has  installed  surveillance 
equipment  in  at  least  17  “internet  hubs”  operated  by  another  major  U.S.  telecommunications 
provider.  Julia  Angwin  et  ah,  NSA  Spying  Relies  on  AT&T’s  ‘Extreme  Willingness  to  Help’, 
ProPublica,  Aug.  15,  2015  (and  associated  documents). 

ALLEGED  VOLUME  AND  GLOBAL  DISTRIBUTION  OF  WIKIMEDIA’S 
INTERNATIONAL,  TEXT-BASED,  INTERNET  COMMUNICATIONS 
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Interrogatory  No,  3: 

Please  identify  eaeh  category  of  Wikimedia  international,  text-based,  Internet 
communications  that  Plaintiff  contends,  for  purposes  of  establishing  jurisdiction,  is  intercepted, 
copied,  and  reviewed  by  the  NSA  in  the  course  of  Upstream  surveillance,  including  but  not  limited 
to,  user  visits  to  Wikimedia  sites;  contributions  and  edits  to  Wikimedia  websites;  Wikimedia 
discussion  forums;  Wikimedia  discussion  pages;  e  mail  sent  via  Wikimedia  among  registered 
users;  communications  “over  wikis”  among  small  or  limited  groups  of  users;  mailing  lists  with 
restricted  membership;  other  use  of  Wikimedia  Projects,  websites,  and  webpages  by  “community 
members”  to  interact  with  one  another;  internal  log  communications;  “Community  Consultations;” 
solicitations  of  user  input  and  preferences;  and  other  communications  sent  and  received  by 
Wikimedia  staff  in  carrying  out  Wikimedia’s  work.  See  Amended  Complaint  79,  84,  86,  92, 
93,  102. 

Response  to  Interrogatory  No,  3: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  further 
objects  that  this  Interrogatory  seeks  information  that  exceeds  the  scope  of  jurisdictional  discovery 
as  defined  by  Defendants,  see  ECF  No.  1 16  at  4,  and  as  ordered  by  the  Court. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows.  As  explained  in  Wikimedia’s  First  Amended  Complaint,  Wikimedia 
contends  that  Upstream  surveillance  implicates  at  least  three  categories  of  communications  (Am. 
Compl.  ][  86):  (1)  Wikimedia  communications  with  its  community  members,  who  read  and 

contribute  to  Wikimedia’s  Projects  and  webpages,  and  who  use  the  Projects  and  webpages  to 
interact  with  each  other.  Examples  of  these  communications  include,  but  are  not  limited  to,  page 
views  to  Wikimedia  websites,  edits  and  contributions  to  Wikimedia  websites,  emails  between 
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registered  Wikimedia  users  and  emails  on  Wikimedia’s  mailing  lists. 

(2)  Wikimedia’s  internal  log  eommunieations. 

(3)  Eleetronic  eommunieations  of  Wikimedia  staff.  Examples  of  these  eommunieations 
inelude,  but  are  not  limited  to,  Gmail,  Google  ehat,  Internet  Relay  Chat,  and  Slaek.  Additionally, 
Wikimedia  staff  members  use  a  variety  of  third-party  tools  to  eonduct  their  work,  ineluding,  but 
not  limited  to,  Google  Apps/G  Suite,  Trello,  Sugar,  Qualtries,  User  Testing  and  Salesforee. 
Interrogatory  No,  4: 

Eor  eaeh  eategory  of  Wikimedia  international,  text-based,  Internet  eommunieations 
identified  in  response  to  Interrogatory  No.  3,  above,  that  Plaintiff  eontends  is  intereepted,  eopied, 
and  reviewed  by  the  NSA  in  the  eourse  of  Upstream  surveillanee,  please  identify  the  submarine  or 
terrestrial  eables  entering  or  exiting  the  United  States  that  have  earried  that  category  of  Wikimedia 
communications  in  the  past  24  months.  To  identify  a  submarine  or  terrestrial  cable  means  to  state 
its  originating  or  terminating  location  in  the  United  States,  to  state  its  terminating  or  originating 
location  abroad,  and  to  identify  the  person(s)  owning  or  controlling  it. 

Response  to  Interrogatory  No,  4: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  further 
objects  that  this  Interrogatory  is  overbroad  and  unduly  burdensome.  Plaintiff  further  objects  that 
this  Interrogatory  seeks  information  that  exceeds  the  scope  of  jurisdictional  discovery  as  defined 
by  Defendants  and  as  ordered  by  the  Court,  and  is  not  reasonably  calculated  to  lead  to  the  discovery 
of  admissible  evidence.  Specifically,  the  categories  of  Plaintiffs  communications  subject  to 
Upstream  surveillance  are  not  relevant  to  Plaintiffs  standing.  Plaintiff  further  objects  that  this 
Interrogatory  seeks  information  that  is  within  Defendants’  control. 

Plaintiff  also  objects  that  this  Interrogatory  is  improperly  compound  in  that  it  contains 
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multiple  subparts.  Plaintiff  additionally  objects  that  these  matters  may  be  the  subject  of  expert 
reports  and  testimony,  as  to  which  Plaintiff  will  provide  discovery  at  the  appropriate  time. 

Plaintiff  therefore  specifically  reserves  the  right  to  supplement  and  amend  its  response 
based  on  further  investigation  and  discovery. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

To  a  near  certainty.  Plaintiffs  communications  traverse  all  submarine  and  major  terrestrial 
cables  carrying  public  Internet  data  into  and  out  of  the  United  States.  Publicly  available  data  shows 
that  submarine  cables  include  those  listed  in  Exhibit  A.  (Exhibit  A  was  created  in  reliance  on 
publicly  available  data  that  Plaintiff  has  not  independently  verified.) 

Interrogatory  No.  5: 

Eor  each  category  of  Wikimedia  international,  text-based,  Internet  communications 
identified  in  response  to  Interrogatory  No.  3,  above,  that  Plaintiff  contends  is  intercepted,  copied, 
and  reviewed  by  the  NS  A  in  the  course  of  Upstream  surveillance,  please  identify  the  Internet 
circuits  entering  or  exiting  the  United  States  that  have  carried  that  category  of  communication  in 
the  past  24  months.  To  identify  a  circuit  means  to  state  its  location  of  entry  to  or  exit  from  the 
United  States,  to  state  its  country  (or,  if  unknown,  global  region(s))  of  origin  or  termination  abroad, 
and  to  identify  the  person(s)  owning  or  controlling  it. 

Response  to  Interrogatory  No,  5: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  also 
objects  that  this  Interrogatory  is  overbroad  and  unduly  burdensome.  Plaintiff  further  objects  that 
this  Interrogatory  seeks  information  that  is  not  reasonably  calculated  to  lead  to  the  discovery  of 
admissible  evidence.  Plaintiff  further  objects  that  this  Interrogatory  seeks  information  that  is 
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within  Defendants’  eontrol. 

Plaintiff  also  objeets  that  this  Interrogatory  is  improperly  eompound  in  that  it  eontains 
multiple  subparts.  Plaintiff  additionally  objeets  that  these  matters  may  be  the  subjeet  of  expert 
reports  and  testimony,  as  to  whieh  Plaintiff  will  provide  diseovery  at  the  appropriate  time. 

Plaintiff  therefore  speeifically  reserves  the  right  to  supplement  and  amend  its  response 
based  on  further  investigation  and  diseovery. 

On  the  basis  of  these  General  and  Speeifie  Objections,  Plaintiff  will  not  provide  a  response 
to  this  Interrogatory. 

Interrogatory  No,  6: 

For  each  category  of  Wikimedia  international,  text-based,  Internet  communications 
identified  in  response  to  Interrogatory  No.  3,  above,  that  Plaintiff  contends  is  intercepted,  copied, 
and  reviewed  by  the  NS  A  in  the  course  of  Upstream  surveillance,  please  identify  each  foreign 
country  to  or  from  which  such  Wikimedia  communications  were  sent  in  the  past  24  months. 
Response  to  Interrogatory  No.  6: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  further 
objects  that  this  Interrogatory  is  overbroad,  unduly  burdensome  and  seeks  information  that  is  not 
reasonably  calculated  to  lead  to  the  discovery  of  admissible  evidence.  Plaintiff  also  objects  that 
this  Interrogatory  is  improperly  compound  in  that  it  contains  multiple  subparts.  Plaintiff  further 
objects  that  this  Interrogatory  seeks  information  that  exceeds  the  scope  of  jurisdictional  discovery 
as  defined  by  Defendants,  see  ECF  No.  1 16  at  4,  and  as  ordered  by  the  Court. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

(1)  Wikimedia  communications  with  its  community  members.  Between  April  23, 2017 
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and  December  3 1 ,  2017,  Wikimedia’s  U.S.  servers  received  HTTPS  requests  from,  and  transmitted 
HTTPS  responses  to,  users  in  at  least  242  non-U.S.  countries,  territories  and  regions.  This  figure 
is  an  estimate  that  was  derived  using  MaxMind  geolocation  data  to  determine  the  country 
associated  with  the  client  IP  of  each  HTTPS  request  transmitted  to  Wikimedia’s  servers  in  the 
United  States. 

(2)  Wikimedia’s  internal  log  communications.  Every  time  Wikimedia  receives  an 
HTTPS  request  from  a  person  accessing  a  Wikimedia  Project  webpage,  it  creates  a  corresponding 
log  entry.  Between  April  23,  2017  and  December  31,  2017,  Wikimedia’s  servers  in  Amsterdam 
transmitted  over  970  billion  logs  to  Wikimedia’s  servers  in  the  United  States. 

(3)  Electronic  communications  of  Wikimedia  staff.  Between  January  1,  2015  and 
December  12,  2017,  Wikimedia’s  office  network  router  located  in  the  United  States  sent  Internet 
communications  to  at  least  approximately  221  non-U.S.  countries,  territories  and  regions. 

This  figure  represents  Internet  outbound  communications  sent  via  the  following  Internet 
protocols:  Transmission  Control  Protocol  (TCP),  User  Datagram  Protocol  (UDP),  and  Internet 
Control  Message  Protocol  (ICMP). 

This  figure  includes  communications  sent  through  Wikimedia’s  Virtual  Private  Network 

(VPN). 

This  figure  does  not  account  for  the  significant  number  of  Internet  communications  by 
Wikimedia  staff  and  contractors  located  internationally,  who  did  not  communicate  using 
Wikimedia’s  Virtual  Private  Network,  but  who  routinely  communicate  with  Wikimedia  staff 
located  at  the  U.S.  headquarters.  Between  January  1,  2015  and  December  22,  2017,  Wikimedia 
engaged  over  80  contractors,  located  across  more  than  30  different  countries. 

The  results  of  these  analyses  will  be  produced  to  Defendants.  An  anonymized  list  of 
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Plaintiffs  contractors  located  abroad  will  also  be  produeed  to  Defendants. 

Interrogatory  No,  7: 

For  eaeh  eategory  of  Wikimedia  international,  text-based,  Internet  eommunieations 
identified  in  response  to  Interrogatory  No.  3,  above,  that  Plaintiff  eontends  is  intereepted,  eopied, 
and  reviewed  by  the  NS  A  in  the  eourse  of  Upstream  surveillanee,  please  state  the  total  number  of 
sueh  Wikimedia  eommunieations  made  to  and  from  the  United  States  eaeh  year  for  the  years  2008- 
2017,  specifying  in  each  case  the  manner  in  whieh  Wikimedia  counts  the  eommunieations  in  that 
eategory  (e.g.,  by  site  visit,  page  view,  HTTP  or  HTTPS  transmissions,  e-mails,  other  forms  of 
messaging,  ete.). 

Response  to  Interrogatory  No.  7: 

In  addition  to  the  General  Objeetions  above  whieh  are  ineorporated  herein.  Plaintiff  further 
objeets  that  this  Interrogatory  is  vastly  overbroad,  unduly  burdensome  and  seeks  information  that 
is  not  reasonably  ealculated  to  lead  to  the  diseovery  of  admissible  evidenee.  Plaintiff  also  objeets 
that  this  Interrogatory  is  improperly  eompound  in  that  it  eontains  multiple  subparts.  Plaintiff 
further  objeets  that  this  Interrogatory  seeks  information  that  exeeeds  the  scope  of  jurisdietional 
diseovery  as  defined  by  Defendants,  see  ECF  No.  1 16  at  4,  and  as  ordered  by  the  Court. 

Subject  to  and  without  waiving  any  of  these  General  or  Specifie  Objeetions,  Plaintiff 
responds  as  follows. 

(1)  Wikimedia  communications  with  its  community  members.  Between  April  23, 2017 
and  Deeember  3 1 ,  2017,  Wikimedia’s  U.S.  servers  reeeived  over  500  billion  HTTPS  requests  from 
users  outside  of  the  United  States.  Eaeh  HTTPS  request  generates  a  eorresponding  response;  thus 
Wikimedia  exehanged  over  1  trillion  HTTPS  requests  and  responses  with  its  users  between  April 
23,  2017  and  December  31,  2017.  These  figures  are  estimates  that  were  derived  using  MaxMind 
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geolocation  data  to  determine  the  country  associated  with  the  client  IP  of  each  HTTPS  request 
transmitted  to  Wikimedia’s  servers  in  the  United  States. 

(2)  Wikimedia’s  internal  log  communications.  Between  April  23,  2017  and  December 
31,  2017,  Wikimedia’s  servers  in  Amsterdam  transmitted  approximately  over  970  billion  logs  to 
Wikimedia’s  servers  in  the  United  States. 

(3)  Electronic  communications  of  Wikimedia  staff.  Between  June  4,  2014  and 
December  12,  2017,  Wikimedia’s  office  network  router  located  in  the  United  States  made  at  least 
approximately  22,934,372  Internet  connections  to  223  non-U. S.  countries,  territories  and  regions. 

This  figure  is  an  estimate  and  was  derived  using  a  geolocation  database  that  catalogues  the 
IP  addresses  associated  with  each  country,  territory  and  region  for  each  log  entry  obtained  from 
the  Wikimedia  Foundation’s  office  router. 

This  figure  represents  the  total  number  of  Internet  outbound  connections  sent  via  the 
following  Internet  protocols:  Transmission  Control  Protocol  (TCP),  User  Datagram  Protocol 
(UDP),  and  Internet  Control  Message  Protocol  (ICMP). 

This  figure  includes  connections  sent  through  Wikimedia’s  Virtual  Private  Network 

(VPN). 

This  figure  does  not  account  for  the  significant  number  of  Internet  communications  by 
Wikimedia  staff  and  contractors  located  internationally  who  did  not  communicate  using 
Wikimedia’s  Virtual  Private  Network,  but  who  routinely  communicate  with  Wikimedia  staff 
located  at  the  U.S.  headquarters.  Between  January  1,  2015  and  December  22,  2017,  Wikimedia 
engaged  over  80  contractors,  located  across  more  than  30  different  countries. 

The  results  of  these  analyses  will  be  produced  to  Defendants.  An  anonymized  list  of 
Plaintiffs  contractors  located  abroad  will  also  be  produced  to  Defendants 
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Interrogatory  No,  8: 

For  each  category  of  Wikimedia  international,  text-based,  Internet  communications 
identified  in  response  to  Interrogatory  No.  3,  above,  that  Plaintiff  contends  is  intercepted,  copied, 
and  reviewed  by  the  NSA  in  the  course  of  Upstream  surveillance,  please  state  by  foreign  country 
the  number  of  such  Wikimedia  communications  made  to  or  from  the  United  States  each  year  for 
the  years  2008-2017,  specifying  in  each  case  the  manner  in  which  Wikimedia  counts  the 
communications  in  that  category  (e.g.,  by  site  visit,  page  view,  HTTP  or  HTTPS  transmissions,  e- 
mails,  other  forms  of  messaging,  etc.). 

Response  to  Interrogatory  No,  8: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  further 
objects  that  this  Interrogatory  is  vastly  overbroad,  unduly  burdensome  and  seeks  information  that 
is  not  reasonably  calculated  to  lead  to  the  discovery  of  admissible  evidence.  Plaintiff  also  objects 
that  this  Interrogatory  is  improperly  compound  in  that  it  contains  multiple  subparts.  Plaintiff 
further  objects  that  this  Interrogatory  seeks  information  that  exceeds  the  scope  of  jurisdictional 
discovery  as  defined  by  Defendants,  see  ECF  No.  1 16  at  4,  and  as  ordered  by  the  Court.  Plaintiff 
additionally  objects  to  this  Interrogatory  as  duplicative  of  other  written  discovery  propounded  by 
Defendants. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

(1)  Wikimedia  communications  with  its  community  members.  The  number  of  HTTPS 
requests  that  Wikimedia’s  U.S.  servers  received  from  users  in  each  country,  territory,  or  region 
between  April  23,  2017  and  December  31,  2017  is  attached  as  Exhibit  B  and  will  be  included  in  a 
forthcoming  production  to  Defendants.  Each  HTTPS  request  generates  a  corresponding  response 
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that  is  not  reflected  in  the  figures  included  in  this  analysis.  These  figures  are  estimates  that  were 
derived  using  MaxMind  geolocation  data  to  determine  the  country  associated  with  the  client  IP  of 
each  HTTPS  request  transmitted  to  Wikimedia’s  servers  in  the  United  States. 

(2)  Wikimedia’s  internal  log  communications.  Between  April  23,  2017  and  December 
31,  2017,  Wikimedia’s  servers  in  Amsterdam  transmitted  over  970  billion  logs  to  Wikimedia’s 
servers  in  the  United  States. 

(3)  Electronic  communications  of  Wikimedia  staff.  Between  June  4,  2014  and 
December  12,  2017,  Wikimedia’s  office  network  router  located  in  the  United  States  sent  at  least 
approximately  22,934,372  Internet  connections  to  at  least  223  non-U. S.  countries,  territories  and 
regions.  A  list  of  the  numbers  of  these  communications  broken  down  by  country,  territory,  or 
region  will  be  produced  to  Defendants. 

These  figures  are  estimates  and  were  derived  using  a  geolocation  database  that  catalogues 
the  IP  addresses  associated  with  each  country,  territory  and  region  for  each  log  entry  obtained  from 
the  Wikimedia  Foundation’s  office  router. 

These  figures  represent  the  total  number  of  Internet  outbound  connections  sent  via  the 
following  Internet  protocols:  Transmission  Control  Protocol  (TCP),  User  Datagram  Protocol 
(UDP),  and  Internet  Control  Message  Protocol  (ICMP). 

These  figures  include  connections  sent  through  Wikimedia’s  Virtual  Private  Network 

(VPN). 

These  figures  do  not  account  for  the  significant  number  of  Internet  communications  by 
Wikimedia  staff  and  contractors  located  internationally  who  did  not  communicate  using 
Wikimedia’s  Virtual  Private  Network,  but  who  routinely  communicate  with  Wikimedia  staff 
located  at  the  U.S.  headquarters.  Between  January  1,  2015  and  December  22,  2017,  Wikimedia 
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engaged  over  80  contractors,  located  across  more  than  30  different  countries. 

The  results  of  these  analyses  will  be  produced  to  Defendants.  An  anonymized  list  of 
Plaintiffs  staff  and  contractors  located  abroad  will  also  be  produced  to  Defendants. 
Interrogatory  No,  9: 

Please  identify  the  location,  by  (i)  nation,  (ii)  state,  province,  or  the  equivalent,  as 
applicable,  and  (ill)  city,  town,  or  county,  as  applicable,  of  each  of  Wikimedia’s  servers  on  which 
one  or  more  of  its  “wiki”-based  Projects  and  other  related  websites  and  pages  (see  Amended 
Complaint  T1 78),  is  or  since  2008  has  been  hosted,  specifying  which  of  Wikimedia’s  Projects,  sites, 
or  pages  is  hosted  in  whole  or  in  part  on  each  server. 

Response  to  Interrogatory  No.  9: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  further 
objects  that  this  Interrogatory  is  overbroad,  unduly  burdensome  and  seeks  information  that  is  not 
reasonably  calculated  to  lead  to  the  discovery  of  admissible  evidence.  Plaintiff  additionally  objects 
that  this  Interrogatory  is  impracticable  in  that  it  requests  the  identification  of  each  webpage  that 
has  been  hosted  by  a  particular  server.  Plaintiff  also  objects  that  this  Interrogatory  is  improperly 
compound  in  that  it  contains  multiple  subparts.  Plaintiff  additionally  objects  that  the  term  “server” 
and  the  phrases  “in  whole  or  in  part”  are  vague  and  ambiguous  in  the  context  of  this  Interrogatory. 
Plaintiff  further  objects  that  this  Interrogatory  seeks  information  that  exceeds  the  scope  of 
jurisdictional  discovery  as  defined  by  Defendants,  see  ECF  No.  116  at  4,  and  as  ordered  by  the 
Court. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

The  following  is  a  list  of  the  locations  of  each  Wikimedia  server  on  which  one  more  of  its 
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“wiki”-based  Projects  and  other  related  websites  and  pages  is  or  at  some  point  in  time  between 
2008  and  the  present  has  been  hosted. 

•  United  States 

o  Ashburn,  Virginia 
o  Carrollton,  Texas 
o  Chicago,  Illinois 
o  Dallas,  Texas 
o  San  Francisco,  California 
o  Tampa,  Florida 

•  The  Netherlands 

o  Amsterdam,  North  Holland 
o  Haarlem,  North  Holland 

•  South  Korea 
o  Seoul 

For  purposes  of  this  response.  Wikimedia  construes  the  term  “server”  to  mean  any  public 
facing  Internet  access  point  operated  by  Wikimedia. 

The  remainder  of  this  Interrogatory  calls  for  information  that  exceeds  the  scope  of 
jurisdictional  discovery  and  Plaintiff  therefore  will  not  provide  a  response  at  this  time. 
Interrogatory  No.  10: 

Please  state  the  number  of  “logs”  or  “log  entries”  (or,  if  not  equivalent,  both)  contained  in 
each  “log  communication”  sent  from  Wikimedia  servers  abroad  to  Wikimedia  servers  in  the  United 
States,  and  the  frequency  with  which  such  log  communications  are  sent.  See  Amended  Complaint 
1193. 
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Response  to  Interrogatory  No,  10: 

In  addition  to  the  General  Objeetions  above  whieh  are  ineorporated  herein,  Plaintiff  further 
objects  that  this  Interrogatory  is  vague  and  ambiguous,  overbroad,  and  not  reasonably  limited  in 
time.  Plaintiff  also  objects  that  this  Interrogatory  is  improperly  compound  in  that  it  contains 
multiple  subparts.  Plaintiff  additionally  objects  to  this  Interrogatory  as  duplicative  of  other  written 
discovery  propounded  by  Defendants. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

One  log  or  log  entry  is  contained  in  a  single  communication.  The  frequency  of  log 
communications  transmitted  to  Wikimedia’s  servers  from  outside  of  the  United  States  is  set  forth 
in  Plaintiffs  response  to  Interrogatory  No.  8. 

Interrogatory  No,  11: 

Please  state  the  basis  of  Plaintiff  s  allegations,  in  paragraphs  61,  85,  and  88  of  the  Amended 
Complaint,  that  Wikimedia’s  alleged  “community  of  volunteers,  contributors,  and  readers  consists 
of  individuals  in  virtually  every  country  on  earth”  and  that  Wikimedia  “communicate[s]  with 
individuals  in  virtually  every  country  on  earth.” 

Response  to  Interrogatory  No,  11: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  objects 
that  this  Interrogatory  is  overbroad  and  duplicative  of  other  written  discovery  propounded  by 
Defendants.  Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

Numerous  facts  support  Wikimedia’s  allegations  that  its  “community  of  volunteers, 
contributors,  and  readers  consists  of  individuals  in  virtually  every  country  on  earth”  and  that 
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Wikimedia  engages  in  “communieations  .  .  .  with  individuals  in  virtually  every  eountry  on  earth.” 
As  explained  in  Wikimedia’s  responses  to  NSA  Interrogatory  Nos.  6-8,  Wikimedia  users  from  all 
over  the  world  read  and  contribute  to  Wikimedia’s  Project  pages.  This  analysis  is  further  supported 
by  statistics  showing  that  Wikimedia’s  Project  pages  are  edited  and  viewed  by  millions  of  users 
around  the  world.  Wikimedia  publishes  current  monthly  page  view  statistics  by  country  {available 
at 

https://stats.wikimedia.org/wikimedia/squids/SquidReportPageViewsPerCountryOverview.htm), 
and  maintains  an  archive  with  analogous  data  for  past  months  {available  at 
https://stats.wikimedia.org/archive/squid_reports/). 

Wikimedia  also  has  dozens  of  foreign  independent  but  associated  entities,  including  user 
groups,  chapters  and  thematic  organizations.  See 

https://meta.wikimedia.Org/wiki/Wikimedia_movement_afliliates#chapters. 

In  the  last  two  years  alone.  Wikimedia  has  awarded  grants  and  scholarships  to  users  and 
programs  in  dozens  of  countries.  Additionally,  Wikimedia  projects  are  currently  active  in  288 
languages,  further  underscoring  Wikimedia’s  global  presence.  See 

https://en.wikipedia.org/wiki/List_of_Wikipedias. 

Interrogatory  No,  12: 

Please  state  the  basis  of  Plaintiff  s  allegation,  in  paragraph  61  of  the  Amended  Complaint, 
that  “Plaintiff[’s]  communications  almost  certainly  traverse  every  international  backbone  link 
connecting  the  United  States  with  the  rest  of  the  world,”  and  the  related  contention  that 
“Plaintiff[’s]  communications  almost  certainly  traverse  every  major  internet  circuit  connecting  the 
United  States  with  the  rest  of  the  world,”  see  PL’s  0pp.  to  Defs.’  MTD  at  23,  including  as  part  of 
the  response  a  specification  of  what  Plaintiff  means  by  the  term  “link”  and  “circuit”  and  the 
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identification  by  location  and  ownership  or  control  of  each  such  international  backbone  link  or 
circuit  that  Wikimedia  communications  allegedly  traverse. 

Response  to  Interrogatory  No.  12: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein,  Plaintiff  objects 
that  this  Interrogatory  is  improperly  compound  in  that  it  contains  multiple  subparts.  Plaintiff 
further  objects  that  this  Interrogatory  is  a  contention  Interrogatory  that  is  premature  at  this  stage  in 
the  litigation.  Plaintiff  additionally  objects  that  these  matters  may  be  the  subject  of  expert  reports 
and  testimony,  as  to  which  Plaintiff  will  provide  discovery  at  the  appropriate  time. 

Plaintiff  therefore  specifically  reserves  the  right  to  supplement  and  amend  its  response 
based  on  further  investigation  and  discovery. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

The  bases  of  Plaintiff  s  allegations  are  the  scope  and  distribution  of  Plaintiff  s  international 
Internet  communications. 

According  to  the  Foreign  Intelligence  Surveillance  Court  and  the  Privacy  and  Civil 
Liberties  Oversight  Board,  Upstream  surveillance  is  directed  at  “circuits”  or  “international  Internet 
hnk[s]”  on  the  Internet  backbone.  See  PCLOB,  Report  on  the  Surveillance  Program  Operated 
Pursuant  to  Section  702  of  FISA  36-37  (2014)  (“PCLOB  Report”);  [Redacted],  2011  WL 
109456 1 8,  at  *15  (FISC  Oct.  3, 201 1).  TheNSA’s  Section  702  targeting  procedures  have  similarly 
described  how  the  NSA  targets  Internet  “links.”  See  Procedures  Used  by  the  National  Security 
Agency  for  Targeting  Non-United  States  Persons  Reasonably  Believed  to  be  Located  Outside  the 
United  States  to  Acquire  Foreign  Intelligence  Information  Pursuant  to  Section  702  of  the  Foreign 
Intelligence  Surveillance  Act  of  1978,  as  Amended  (July  2009),  available  at 
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https://www.aclu.org/files/natsec/nsa/20130816/FAA%20Targeting%20Procedures.pdf. 

Plaintiffs  understanding  is  that  a  “circuit”  or  “link”  is  a  pathway  between  devices  in 
telecommunications  networks.  These  circuits  are  carried  on,  for  example,  physical  media  such  as 
cables  and  fibers,  but  there  is  not  necessarily  a  one-to-one  correspondence  between  each  circuit 
and  its  underlying  means  of  transmission.  For  example,  multiple  circuits  may  traverse  a  single 
fiber,  and  a  single  circuit  may  span  multiple  fibers. 

ALLEGATIONS  REGARDING  NSA  INTERCEPTION  OF  WIKIMEDIA’S 
INTERNATIONAL,  TEXT-BASED,  INTERNET  COMMUNICATIONS 

Interrogatory  No,  13: 

Please  identify  each  of  the  international  Internet  “backbone  chokepoints,”  whether  cables, 
circuits,  or  other  communications  facilities,  at  which  Plaintiff  contends,  in  paragraph  66  of  the 
Amended  Complaint,  the  NSA  must  be  conducting  Upstream  surveillance,  stating  for  each  such 
“backbone  chokepoinf’  the  basis  of  Plaintiff  s  contention. 

Response  to  Interrogatory  No.  13: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  objects 
that  this  Interrogatory  is  improperly  compound  in  that  it  contains  multiple  subparts.  Plaintiff  also 
objects  that  this  Interrogatory  seeks  information  that  is  within  Defendants’  control.  Plaintiff 
further  objects  that  this  Interrogatory  is  a  contention  Interrogatory  that  is  premature  at  this  stage  in 
the  litigation.  Plaintiff  therefore  specifically  reserves  the  right  to  supplement  and  amend  its 
response  based  on  further  investigation  and  discovery. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

An  NSA  document  states  that  the  NSA  has  established  interception  capabilities  on  “many 
of  the  chokepoints  operated  by  U.S.  providers  through  which  international  communications  enter 
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and  leave  the  United  States.”  See  NSA  Staff  Proeessing  Form,  Subjeet:  SSO’s  Support  to  the  FBI 
for  Implementation  of  their  Cyber  FISA  Orders. 

The  “ehokepoints”  at  whieh  the  NSA  eonduets  Upstream  surveillanee  have  ineluded  the 
“seven  aeeess  sites”  identified  in  an  NSA  doeument,  reprodueed  at  paragraph  68  of  Plaintiff  s  First 
Amended  Complaint  (ECF  No.  70-1). 

Additional  reporting  after  the  filing  of  the  Amended  Complaint  states  that  the  NSA  has 
installed  surveillanee  equipment  in  at  least  17  “internet  hubs”  operated  by  another  major  U.S. 
teleeommunieations  provider.  See  Julia  Angwin  et  ah,  NSA  Spying  Relies  on  AT&T’s  ‘Extreme 
Willingness  to  Help’,  ProPubliea,  Aug.  15,  2015  (and  assoeiated  doeuments,  one  of  whieh 
deseribes  the  surveillance  of  hundreds  of  circuits  at  a  specific  AT&T  trans-Pacific  cable  site);  Julia 
Angwin  &  Jeff  Larson,  New  Snowden  Documents  Reveal  Secret  Memos  Expanding  Spying, 
ProPubliea,  June  4,  2015  (and  associated  documents);  Jeff  Larson  et  ah,  A  Trail  of  Evidence 
Leading  to  AT&T’s  Partnership  with  the  NSA,  ProPubliea,  Aug.  15,  2015  (and  associated 
documents)  (describing  surveillance  on  AT&T’s  network,  including  on  “OC-192  and  lOGL 
peering  circuits”;  describing  surveillance  on  Verizon’s  network,  including  at  a  cable-landing  site 
called  BRLCKLNRIDGE). 

Interrogatory  No,  14: 

Please  state  the  basis  of  Plaintiff  s  allegation,  in  paragraph  49  of  the  Amended  Complaint, 
that  Upstream  surveillance  includes  a  process  in  which  the  NSA  makes  a  copy  of  international 
text-based  communications  flowing  across  certain  high-capacity  cables,  switches,  and  routers 
along  the  Internet  backbone. 

Response  to  Interrogatory  No.  14: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  objects 
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that  this  Interrogatory  is  duplicative  of  other  written  discovery  propounded  by  Defendants. 
Plaintiff  additionally  objects  that  these  matters  may  be  the  subject  of  expert  reports  and  testimony, 
as  to  which  Plaintiff  will  provide  discovery  at  the  appropriate  time. 

Plaintiff  therefore  specifically  reserves  the  right  to  supplement  and  amend  its  response 
based  on  further  investigation  and  discovery. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

The  bases  of  Plaintiffs  allegation  are  the  principles  of  Internet  communication  and  the 
technical  necessities  of  the  inspection  of  Internet  communications  in  transit. 

For  example,  Internet  communications  in  transit  are  split  into  packets.  Where  an 
eavesdropper  is  attempting  to  determine  whether  the  contents  of  a  particular  communication  in 
transit  on  the  Internet  contain  a  particular  piece  of  information,  the  eavesdropper  generally  must 
reassemble  the  packets  constituting  the  communication  and  then  scan  the  reassembled 
communication.  Reassembling  Internet  packets  requires  the  temporary  copying  (or  “caching”)  of 
those  packets  until  all  packets  needed  for  the  reassembly  have  arrived. 

Additionally,  Upstream  surveillance  involves  the  retention  of  communications  that  contain 
targeted  selectors.  To  retain  a  communication  in  transit,  an  eavesdropper  must  copy  and 
reassemble  the  packets  constituting  the  communication.  But  because  an  eavesdropper  cannot 
know  in  advance  which  packets  in  transit  are  part  of  a  communication  containing  a  targeted 
selector,  the  eavesdropper  must  create  a  temporary  copy  of  all  packets  that  might  be  a  part  of  such 
a  communication. 

In  addition,  a  New  York  Times  report  from  August  2013  states,  based  on  a  review  of  NSA 
documents  and  interviews  with  senior  intelligence  officials,  that  “the  N.S.A.  is  temporarily 
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copying  and  then  sifting  through  the  contents  of  what  is  apparently  most  e-mails  and  other  text- 
based  eommunieations  that  eross  the  border.”  Charlie  Savage,  N.S.A  Said  to  Search  Content  of 
Messages  to  and from  U.S.,S\.Y.  Times,  Aug.  8,  2013;  see  also  Charlie  Savage,  Power  Wars  207- 
11  (2015). 

Interrogatory  No,  15: 

Please  state  the  basis  of  Plaintiff  s  eontentions  regarding  the  manner  in  whieh  the  alleged 
eopying,  filtering,  and  eontent-review  proeesses  referred  to  in  paragraph  49  of  the  Amended 
Complaint  are  earned  out. 

Response  to  Interrogatory  No,  15: 

In  addition  to  the  General  Objections  above  whieh  are  ineorporated  herein.  Plaintiff  objeets 
that  this  Interrogatory  is  a  contention  Interrogatory  that  is  premature  at  this  stage  in  the  litigation. 
Plaintiff  additionally  objeets  that  these  matters  may  be  the  subjeet  of  expert  reports  and  testimony, 
as  to  whieh  Plaintiff  will  provide  discovery  at  the  appropriate  time. 

Plaintiff  therefore  speeifieally  reserves  the  right  to  supplement  and  amend  its  response 
based  on  further  investigation  and  diseovery.  Plaintiff  also  objeets  that  this  Interrogatory  is 
overbroad  and  duplieative  of  other  written  diseovery  propounded  by  Defendants. 

Subject  to  and  without  waiving  any  of  these  General  or  Specifie  Objeetions,  Plaintiff 
responds  as  follows. 

The  bases  of  Plaintiff  s  contentions  are  the  principles  of  Internet  eommunieation  and  the 
teehnieal  neeessities  of  the  inspeetion  of  Internet  eommunieations  in  transit. 

For  example,  Internet  eommunieations  in  transit  are  split  into  paekets.  Where  an 
eavesdropper  is  attempting  to  determine  whether  the  eontents  of  a  partieular  eommunieation  in 
transit  on  the  Internet  eontain  a  particular  piece  of  information,  the  eavesdropper  generally  must 
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reassemble  the  packets  constituting  the  communication  and  then  scan  the  reassembled 
communication.  Reassembling  Internet  packets  requires  the  temporary  copying  (or  “caching”)  of 
those  packets  until  all  packets  needed  for  the  reassembly  have  arrived. 

Additionally,  Upstream  surveillance  involves  the  retention  of  communications  that  contain 
targeted  selectors.  To  retain  a  communication  in  transit,  an  eavesdropper  must  copy  and 
reassemble  the  packets  constituting  the  communication.  But  because  an  eavesdropper  cannot 
know  in  advance  which  packets  in  transit  are  part  of  a  communication  containing  a  targeted 
selector,  the  eavesdropper  must  create  a  temporary  copy  of  all  packets  that  might  be  a  part  of  such 
a  communication. 

In  addition,  a  New  York  Times  report  from  August  2013  states,  based  on  a  review  of  NSA 
documents  and  interviews  with  senior  intelligence  officials,  that  “the  N.S.A.  is  temporarily 
copying  and  then  sifting  through  the  contents  of  what  is  apparently  most  e-mails  and  other  text- 
based  communications  that  cross  the  border.”  Charlie  Savage,  N.S.A  Said  to  Search  Content  of 
Messages  to  and from  U.S.,  N.Y.  Times,  Aug.  8,  2013;  see  also  Charlie  Savage,  Power  Wars  207- 
11  (2015). 

Other  bases  of  Plaintiff  s  contentions  include; 

•  The  PCLOB  Report,  including  pages  7-10,  12-13,22,30-41  &n.l57,  79,  111  n.476, 
120-22,  125,  143,  and  official  government  sources  concerning  Upstream  surveillance  cited 
therein. 

•  [Redacted],  No.  [Redacted],  2011  WL  10945618  (FISC  Oct.  3,  2011) 

•  50U.S.C.  §§  1801,  I88Ia. 

•  David  S.  Kris  &  J.  Douglas  Wilson,  National  Security  Investigations  and  Prosecutions 
§  17.5  (July  2015) 
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•  Julia  Angwin  et  al.,  NSA  Spying  Relies  on  AT&T’s  ‘Extreme  Willingness  to  Help’, 
ProPublica,  Aug.  15,  2015  (and  associated  documents) 

•  Julia  Angwin  &  Jeff  Larson,  New  Snowden  Documents  Reveal  Secret  Memos 
Expanding  Spying,  ProPubliea,  June  4,  2015  (and  associated  doeuments) 

•  Jeff  Larson  et  al.,  A  Trail  of  Evidence  Leading  to  AT&T’s  Partnership  with  the  NSA, 
ProPubliea,  Aug.  15,  2015  (and  assoeiated  documents) 

•  PCLOB,  Publie  Hearing  Regarding  the  Surveillance  Program  Operated  Pursuant  to 
Section  702  of  the  Foreign  Intelligence  Surveillanee  Aet  26:15-18  (Mar.  19,  2014)  (statement  of 
Robert  Litt,  General  Counsel,  ODNI) 

•  Charlie  Savage,  Power  Wars  (2015) 

Interrogatory  No.  16: 

Please  state  the  basis  of  Plaintiff  s  allegations  in  paragraph  59  of  the  Amended  Complaint, 
ineluding  the  allegations  that  “[t]he  NSA  could  readily  configure  its  [alleged]  surveillance 
equipment  to  ignore”  Internet  traffic  that  is  “not  amenable  to  . . .  text-based  searehes;”  that  such 
traffic  “is  likely  of  no  foreign-intelligence  interest  to  the  government;”  and  that  “ignor[mg]”  sueh 
traffic  would  result  in  “substantial  efficiency  gains.” 

Response  to  Interrogatory  No,  16: 

In  addition  to  the  General  Objections  above  whieh  are  ineorporated  herein.  Plaintiff 
additionally  objects  that  these  matters  may  be  the  subject  of  expert  reports  and  testimony,  as  to 
whieh  Plaintiff  will  provide  discovery  at  the  appropriate  time. 

Plaintiff  therefore  speeifically  reserves  the  right  to  supplement  and  amend  its  response 
based  on  further  investigation  and  discovery. 

Subject  to  and  without  waiving  any  of  these  General  or  Speeific  Objeetions,  Plaintiff 
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responds  as  follows. 

Plaintiffs  allegations  are  based  on  basie  principles  governing  the  routing  and  transmission 
of  Internet  communications,  as  well  as  basic  principles  governing  how  surveillance  on  a  packet- 
switched  network  operates. 

Plaintiffs  allegations  are  also  based  on  the  fact  that  a  substantial  percentage  of  Internet 
traffic  consists  of  video  traffic;  and  that  video  traffic  from  major  video-traffic  providers,  such  as 
Netflix,  is  likely  of  little  foreign-intelligence  interest  to  the  government  because  it  reflects  only 
movie-  and  television-viewing  habits. 

Interrogatory  No.  17: 

Please  state  the  basis  of  Plaintiffs  allegations,  in  paragraphs  62  and  64  of  the  Amended 
Complaint,  respectively,  that  “in  order  for  the  NSA  to  reliably  obtain  communications  to,  from,  or 
about  its  targets  in  the  way  it  has  described,  the  government  must  be  copying  and  reviewing  all  the 
international  text-based  communications  that  travel  across  a  given  link,”  and  that  “for  every 
backbone  link  that  the  NSA  monitors  using  Upstream  surveillance,  the  monitoring  must  be 
comprehensive  in  order  for  the  government  to  accomplish  its  stated  goals.” 

Response  to  Interrogatory  No.  17: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  objects 
that  this  Interrogatory  is  improperly  compound  in  that  it  contains  multiple  subparts.  Plaintiff  also 
objects  that  this  Interrogatory  is  duplicative  of  other  written  discovery  propounded  by  Defendants. 
Plaintiff  additionally  objects  that  these  matters  may  be  the  subject  of  expert  reports  and  testimony, 
as  to  which  Plaintiff  will  provide  discovery  at  the  appropriate  time.  Plaintiff  therefore  specifically 
reserves  the  right  to  supplement  and  amend  its  response  based  on  further  investigation  and 
discovery. 
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Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

Plaintiffs  allegation  is  based  on  basic  principles  governing  the  routing  and  transmission  of 
Internet  communications,  as  well  as  basic  principles  governing  how  surveillance  on  a  packet- 
switched  network  operates. 

Interrogatory  No,  18: 

Please  state  the  basis  of  Plaintiff  s  allegation,  in  paragraph  63  of  the  Amended  Complaint, 
that  “[t]o  search  the  contents  of  any  text-based  communication  for  instances  of  the  NSA’s 
‘selectors’  as  that  communication  traverses  a  particular  backbone  link,  the  government  must  first 
copy  and  reassemble  all  of  the  packets  that  make  up  that  communication.” 

Response  to  Interrogatory  No.  18: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  objects 
that  this  Interrogatory  seeks  information  that  is  the  subject  of  expert  reports  and  testimony,  as  to 
which  Plaintiff  will  provide  discovery  at  the  appropriate  time.  Plaintiff  therefore  specifically 
reserves  the  right  to  supplement  and  amend  its  response  based  on  further  investigation  and 
discovery. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

Plaintiffs  allegation  is  based  on  basic  principles  governing  the  routing  and  transmission  of 
Internet  communications,  as  well  as  basic  principles  governing  how  surveillance  on  a  packet- 
switched  network  operates. 

Interrogatory  No,  19: 

Please  state  with  particularity  what  Plaintiff  means  by  the  term  “reliably”  as  used  in 
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paragraphs  62,  63,  and  66  of  the  Amended  Complaint  in  the  phrases  “reliably  obtain 
eommunieations,”  and  “reliably  intereept  . . .  eommunieations,”  and  as  the  term  “reliably,”  or  its 
equivalent,  may  be  used  in  Plaintiffs  response  to  any  of  Defendants’  other  interrogatories. 
Response  to  Interrogatory  No.  19: 

In  addition  to  the  General  Objeetions  above  whieh  are  ineorporated  herein.  Plaintiff  objeets 
that  this  Interrogatory  is  eompound,  vague,  ambiguous  and  overly  burdensome  in  that  it  requests 
that  Plaintiff  define  its  use  of  the  word  “reliably”  in  a  variety  of  diserete  eontexts,  and  in  that  it 
ealls  for  a  subjeetive  judgment  about  what  terms  are  “equivalent”  to  the  term  “reliably.”  Plaintiff 
additionally  objects  that  these  matters  may  be  the  subject  of  expert  reports  and  testimony,  as  to 
which  Plaintiff  will  provide  discovery  at  the  appropriate  time.  Plaintiff  therefore  specifically 
reserves  the  right  to  supplement  and  amend  its  response  based  on  further  investigation  and 
discovery. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

The  PCLOB  has  described  the  use  of  Upstream  surveillance  to  collect  “about” 
communications  as  “an  inevitable  byproduct  of  the  government’s  efforts  to  comprehensively 
acquire  communications  that  are  sent  to  or  from  its  targets.”  PCLOB  Report  10.  And  it  has  said 
about  Upstream  surveillance  more  generally  that  this  method’s  “success  .  .  .  depends  on  collection 
devices  that  can  reliably  acquire  data  packets  associated  with  the  proper  communications.”  Id.  at 
143  (emphasis  added). 

Plaintiffs  complaint  uses  the  term  “reliably”  in  different  ways  depending  on  context.  For 
example,  in  paragraphs  62  and  63  of  the  Amended  Complaint,  Plaintiff  uses  the  term  “reliably”  to 
signify  that  the  government  could  not  conduct  Upstream  surveillance  as  it  has  publicly  described 
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it  without  undertaking  certain  steps.  Paragraph  66  of  Plaintiffs  complaint  quotes  the  PCLOB’s 
use  of  the  term  “reliably.” 

Interrogatory  No,  20: 

Please  state  the  basis  of  Plaintiffs  allegations,  in  paragraphs  65  and  66  of  the  Amended 
Complaint,  that  in  conducting  Upstream  surveillance  “the  government’s  aim  is  to 
‘comprehensively’  ...  obtain  communications  to,  from,  and  about  targets  scattered  around  the 
world,”  and  that  “the  government  is  interested  in  obtaining,  with  a  high  degree  of  confidence,  all 
international  communications  to,  from,  or  about  its  targets.” 

Response  to  Interrogatory  No,  20: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  objects 
that  this  Interrogatory  is  duplicative  of  other  written  discovery  propounded  by  Defendants. 
Plaintiff  also  objects  that  this  Interrogatory  is  improperly  compound  in  that  it  contains  multiple 
subparts. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

The  PCLOB  has  described  the  use  of  Upstream  surveillance  to  collect  “about” 
communications  as  “an  inevitable  byproduct  of  the  government’s  efforts  to  comprehensively 
acquire  communications  that  are  sent  to  or  from  its  targets.”  PCLOB  Report  10.  And  it  has  said 
about  Upstream  surveillance  more  generally  that  this  method’s  “success  . . .  depends  on  collection 
devices  that  can  reliably  acquire  data  packets  associated  with  the  proper  communications.”  Id.  at 
143  (emphasis  added);  see  also  PCLOB,  Public  Hearing  Regarding  the  Surveillance  Program 
Operated  Pursuant  to  Section  702  of  the  Foreign  Intelligence  Surveillance  Act  26:15-18  (Mar.  19, 
2014)  (statement  of  Robert  Litt,  General  Counsel,  ODNI). 
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Interrogatory  No,  21: 

To  the  extent  not  already  stated  or  identified  in  response  to  Interrogatory  Nos.  13-20, 
above,  or  in  response  to  Defendant  United  States  Department  of  Justiee’s  First  Set  of 
Interrogatories,  Interrogatory  Nos.  1-6,  please  state  the  basis  of  Plaintiff  s  contention  that  the  NSA 
is  intercepting,  copying,  and  reviewing  at  least  some  of  its  communications. 

Response  to  Interrogatory  No.  21: 

In  addition  to  the  General  Objections  above  which  are  incorporated  herein.  Plaintiff  objects 
that  this  Interrogatory  is  a  contention  Interrogatory  that  is  premature  at  this  stage  in  the  litigation. 
Plaintiff  also  objects  that  this  Interrogatory  seeks  information  that  is  the  subject  of  expert  reports 
and  testimony,  as  to  which  Plaintiff  will  provide  discovery  at  the  appropriate  time.  Plaintiff 
therefore  specifically  reserves  the  right  to  supplement  and  amend  its  response  based  on  further 
investigation  and  discovery.  Plaintiff  also  objects  that  this  Interrogatory  is  overbroad  and 
duplicative  of  other  written  discovery  propounded  by  Defendants. 

Subject  to  and  without  waiving  any  of  these  General  or  Specific  Objections,  Plaintiff 
responds  as  follows. 

Plaintiffs  contention  is  based  on  the  volume  and  distribution  of  its  communications,  basic 
principles  governing  the  routing  and  transmission  of  Internet  communications,  and  basic  principles 
governing  how  surveillance  on  a  packet-switched  network  operates. 
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Dated;  January  1 1 ,  20 1 8 


/s/Ashley  Gorski 

Ashley  Gorski 

AMERICAN  CIVIL  LIBERTIES  UNION 

EOUNDATION 

125  Broad  Street,  18th  Floor 

New  York,  NY  10004 

Phone:  (212)  549-2500 

Fax:  (212)  549-2654 

agorski@aclu.org 

Counsel  for  Plaintiff  Wikimedia  Foundation,  Inc. 
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EXHIBIT  A 
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Report  on  International  Submarine  Cables  Landing 
in  the  US 


Source;  underlying  data  eloned  from  https://github.eom/telegeographv/www.submarinecablemap.eom.  most 
reeent  eommit  at  2018-01-02  14:09:33-05:00  (7d7od9e8096d624717f2b4e56ebo72831e2ba7f6) 

•  US  Landing  Points  for  International  Submarine  Cables 

•  International  Submarine  Cables  Landing  in  the  US 
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US  Landing  Points  for  International  Submarine 
Cables 


Landing  1 


Bandon.  Oregon,  United  States 


Location:  (124.4°W,  43.12°N) 
1  International  Cable: 

•  FASTER 


Owners: 

Google,  KDDI,  SingTel,  China  Telecom,  China  Mobile,  Global  Transit 
Other  Countries: 

Japan,  Taiwan 


Landing  2 


Bellport  New  York,  United  States 


Location:  (72.94°W,  40.76°N) 
1  International  Cable: 

•  Yellow 


Owners: 

Level  3 

Other  Country: 

United  Kingdom 
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Boca  Raton,  FL,  United  States 


Location:  (80.09°W,  26.35°N) 

6  International  Cables: 

•  South  Ameriea-1  tSAm-11 

Owners: 

Telxius 

Other  Countries: 

Argentina,  Brazil,  Chile,  Colombia,  Dominiean  Republie,  Eeuador,  Guatemala,  Peru 

•  Bahamas  Internet  Cable  System  tBICSl 

Owners: 

Caribbean  Crossings 
Other  Country: 

Bahamas 

•  Monet 
Owners: 

Angola  Cables,  Google,  Algar  Telecom,  Antel  Uruguay 
Other  Country: 

Brazil 

•  Deep  Blue  Cable 
Owners: 

Deep  Blue  Cable 
Other  Countries: 

Anguilla,  Aruba,  Bonaire,  Sint  Eustatius,  and  Saba,  Cayman  Islands,  Colombia,  Cura9ao, 
Dominiean  Republie,  Haiti,  Jamaiea,  Panama,  Saint  Martin,  Trinidad  and  Tobago,  Turks  and 
Caieos  Islands 

•  GlobeNet 

Owners: 

BTG  Pactual 
Other  Countries: 

Bermuda,  Brazil,  Colombia,  Venezuela 

•  Colombia-Florida  Subsea  Tiber  (CFX-1) 

Owners: 

C&W  Networks 
Other  Countries: 

Colombia,  Jamaiea 


Landing  3 
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Brookhaven,  New  York,  United  States 


Location:  (72.9 1°W,  40.77°N) 

1  International  Cable: 

•  Atlantie  Crossing- 1  tAC-11 

Owners: 

Level  3 

Other  Countries: 

Germany,  Netherlands,  United  Kingdom 


Buffalo,  New  York.  United  States 


Loeation:  (78.88°W,  42.89°N) 

1  International  Cable: 

•  Crosslake  Fibre 

Owners: 

Crosslake  Fibre 
Other  Country: 

Canada 


Charlestown,  Rhode  Island,  United  States 


Loeation:  (7L65°W,  4L41°N) 

1  International  Cable: 

•  Challenger  Bermuda- 1  (CB-11 

Owners: 

Cable  Co. 

Other  Country: 

Bermuda 


Landing  6 


Landing  5 


Landing  4 
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El  Segundo,  California,  United  States 

Location:  (118.4°W,  33.92°N) 

1  International  Cable: 

•  Paeifie  Light  Cable  Network  tPLCNl 

Owners: 

Paeifie  Light  Data  Communieation  Co.  Ltd.,  Google,  Facebook 
Other  Countries: 

China,  Philippines,  Taiwan 


Grover  Beach.  California.  United  States 


Loeation:  (120.6°W,  35.12°N) 

2  International  Cables: 

•  Pan-Ameriean  Crossing  tPACl 

Owners: 

Level  3 

Other  Countries: 

Costa  Riea,  Mexieo,  Panama 

•  Paeifie  Crossing- 1  iPC-ll 

Owners: 

NTT 

Other  Country: 

Japan 
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Landing  9 


Harbour  Pointe,  Washington,  United  States 


Location:  (122.3°W,  47.89°N) 

1  International  Cable: 

•  Paeifie  Crossing- 1  iPC-ll 

Owners: 

NTT 

Other  Country: 

Japan 


Hermosa  Beach,  California.  United  States 


Loeation:  (118.4°W,  33.86°N) 

2  International  Cables: 

•  JUPITER 
Owners: 

Amazon,  Faeebook,  NTT,  PLOT,  PCCW,  Softbank  Teleeom 
Other  Countries: 

Japan,  Philippines 

•  SEA-US 
Owners: 

RTI,  Inc.,  Globe  Teleeom,  Hawaiian  Telcom,  GTA  TeleGuam,  Telin,  Balau  Submarine  Cable 
Company,  Federated  States  of  Micronesia  Telecommunieations  Company 
Other  Countries: 

Federated  States  of  Mieronesia,  Indonesia,  Palau,  Philippines 
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Landing  11 


Hillsboro,  Oregon,  United  States 


Location:  (123°W,  45.52°N) 

2  International  Cables: 

•  Southern  Cross  Cable  Network  tSCCNl 

Owners: 

Spark  New  Zealand,  SingTel  Optus,  Verizon 
Other  Countries: 

Australia,  Fiji,  New  Zealand 

•  Tata  TGN-Pacifie 


Owners: 

Tata  Communieations 
Other  Country: 

Japan 
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Landing  12 


Hollywood,  Florida,  United  States 


Location:  (80.16°W,  26.0 1°N) 
4  International  Cables: 

•  Columbus-III 


Owners: 

Teleeom  Italia  Sparkle,  AT&T,  Verizon,  Telefoniea,  Portugal  Teleeom,  Tata  Communications, 
Ukrtelecom,  Telkom  South  Afriea,  Telecom  Argentina,  Instituto  Costarrieense  de  Eleetricidad, 
Embratel,  Cyta 
Other  Countries: 

Italy,  Portugal,  Spain 

•  America  Movil  Submarine  Cable  System- 1  (AMX-11 

Owners: 

Ameriea  M6vil 
Other  Countries: 

Brazil,  Colombia,  Dominican  Republic,  Guatemala,  Mexico 

•  Americas-II 


Owners: 

Embratel,  AT&T,  Verizon,  Sprint,  CANTV,  Tata  Communieations,  Eevel  3,  Teleeom  Argentina, 
Orange,  Portugal  Teleeom,  C&W  Networks,  Teleeom  Italia  Sparkle,  Entel  Chile 
Other  Countries: 

Brazil,  Curasao,  Trench  Guiana,  Martinique,  Trinidad  and  Tobago,  Venezuela 
•  Mava-1 
Owners: 

Verizon,  AT&T,  Sprint,  Hondutel,  Telefoniea,  Orbitel,  Teleeom  Italia  Sparkle,  C&W  Networks, 
Entel  Chile,  Embratel,  ETB,  Axtel,  Instituto  Costarrieense  de  Eleetrieidad,  Proximus,  Prepa 
Networks,  Orange,  Tricorn,  RSL  Telecom,  America  M6vil 
Other  Countries: 

Cayman  Islands,  Colombia,  Costa  Riea,  Honduras,  Mexico,  Panama 
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Island  Park,  New  York,  United  States 


Location:  (73.66°W,  40.6°N) 

1  International  Cable: 

•  FLAG  Atlantie  - 1  tFA- 1 1 

Owners: 

Global  Cloud  Xehange 
Other  Countries: 

Franee,  United  Kingdom 


Isla  Verde.  Puerto  Rico.  United  States 


Loeation:  (66.02°W,  18.44°N) 

3  International  Cables: 

•  Saint  Maarten  Puerto  Rieo  Network  One  (SMPR-11 

Owners: 

TelEm  Group,  Dauphin  Teleeom 
Other  Countries: 

Saint  Martin,  Sint  Maarten 

•  ARCOS 
Owners: 

C&W  Networks,  CANTV,  Codetel,  Hondutel,  Belize  Telemedia,  Enitel,  AT&T,  Alestra, 
Verizon,  RACSA,  United  Telecommunication  Services  (UTS),  Teleearrier,  Tricorn  USA, 
Telecomunicaciones  Ultramarinas  de  Puerto  Rieo,  Intemexa,  Orbinet  Overseas,  Telepuerto  San 
Isidro,  Bahamas  Telecommunieations  Company,  Instituto  Costarrieense  de  Eleetrieidad,  Orbitel 
Other  Countries: 

Bahamas,  Belize,  Colombia,  Costa  Riea,  Cura9ao,  Dominiean  Republie,  Guatemala,  Honduras, 
Mexieo,  Niearagua,  Panama,  Turks  and  Caicos  Islands,  Venezuela 

•  Antillas  1 
Owners: 

AT&T,  Verizon,  Sprint,  Tata  Communieations,  Orange,  C&W  Networks,  Telecom  Italia 
Sparkle,  Embratel 
Other  Country: 

Dominiean  Republie 
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Jacksonville,  Florida,  United 


Location:  (81.66°W,  30.33°N) 

3  International  Cables: 

•  Ameriea  Movil  Submarine  Cable  System- 1  tAMX-11 

Owners: 

Ameriea  Movil 
Other  Countries: 

Brazil,  Colombia,  Dominiean  Republie,  Guatemala,  Mexieo 

•  South  Ameriea  Pacific  Link  tSAPLl 

Owners: 

Oeean  Networks 
Other  Countries: 

Chile,  Panama 

•  Pacifie  Caribbean  Cable  System  (PCCSl 

Owners: 

C&W  Networks,  Teleonet,  Setar,  United  Teleeommunieation  Serviees  (UTS),  Telxius 
Other  Countries: 

Aruba,  Colombia,  Cura9ao,  Eeuador,  Panama 


Kahe  Point,  Hawaii,  United  States 


Loeation:  (158. 1°W,  2L35°N) 

1  International  Cable: 

•  Southern  Cross  Cable  Network  tSCCN) 

Owners: 

Spark  New  Zealand,  SingTel  Optus,  Verizon 
Other  Countries: 

Australia,  Fiji,  New  Zealand 


Landing  16 


States 


Landing  15 
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Kapolet  HL  United  States 


Location:  (158. 1°W,  21.34°N) 

1  International  Cable: 

•  Hawaiki 
Owners: 

Hawaiki  Cable  Company 
Other  Countries: 

Australia,  New  Zealand 


Kawaihae,  Hawaii.  United  States 


Loeation:  (155. 8°W,  20.04°N) 

1  International  Cable: 

•  Honotua 
Owners: 

OPT  Freneh  Polynesia 
Other  Country: 

Freneh  Polynesia 
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Keawaula,  Hawaii,  United  States 


Location:  (158.2°W,  21.43°N) 

2  International  Cables: 

•  Telstra  Endeavour 

Owners: 

Telstra 

Other  Country: 

Australia 

•  Asia-Ameriea  Gateway  tAAGl  Cable  System 

Owners: 

Telekom  Malaysia,  AT&T,  Starhub,  PLDT,  Communieations  Authority  of  Thailand,  Airtel 
(Bharti),  Telstra,  Telkom  Indonesia,  BT,  Eastern  Telecom,  PT  Indonesia  Satellite  Corp.,  Spark 
New  Zealand,  Viettel  Corporation,  Saigon  Postel  Corporation,  Vietnam  Telecom  International, 
Brunei  International  Gateway,  BayanTel,  Ezeeom 
Other  Countries: 

Brunei,  China,  Malaysia,  Philippines,  Singapore,  Thailand,  Vietnam 


Landing  20 


Los  Angeles.  California.  United  States 


Eoeation:  (118.2°W,  34.05°N) 

1  International  Cable: 

•  Tata  TGN-Paeifie 
Owners: 

Tata  Communieations 
Other  Country: 

Japan 
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Lynn,  Massachusetts,  United  States 


Landing  21 


Location:  (70.95°W,  42.46°N) 

1  International  Cable: 

•  GTT  Atlantie 

Owners: 

GTT 

Other  Countries: 

Canada,  Ireland,  United  Kingdom 


Makaha.  Hawaii.  United  States 


Loeation:  (158.2°W,  21.46°N) 

3  International  Cables: 

•  Japan-U.S.  Cable  Network  (JUS) 

Owners: 

Verizon,  AT&T,  BT,  Sprint,  CenturyLink,  KDDI,  NTT,  Chunghwa  Teleeom,  Tata 
Communieations,  SingTel,  Telekom  Malaysia,  Softbank  Teleeom,  Orange,  Level  3,  SK 
Broadband,  KT,  China  Teleeom,  China  Unieom,  LG  Uplus,  HKBN  Enterprise  Solutions, 
Starhub,  PCCW,  Telstra,  Vodafone,  PLDT 
Other  Country: 

Japan 

•  South  Ameriea  Pacific  Link  (SAPLl 

Owners: 

Oeean  Networks 
Other  Countries: 

Chile,  Panama 

•  SEA-US 
Owners: 

RTI,  Inc.,  Globe  Teleeom,  Hawaiian  Telcom,  GTA  TeleGuam,  Telin,  Balau  Submarine  Cable 
Company,  Eederated  States  of  Micronesia  Telecommunieations  Company 
Other  Countries: 

Eederated  States  of  Mieronesia,  Indonesia,  Palau,  Philippines 
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Manasquan,  New  Jersey,  United  States 


Location:  (74.05°W,  40.12°N) 

3  International  Cables: 

•  TAT- 14 
Owners: 

BT,  Verizon,  Deutsehe  Telekom,  Orange,  Sprint,  TeliaSonera,  Level  3,  KPN,  Telenor,  Etisalat, 
OTEGLOBE,  SingTel,  KDDI,  Softbank  Telecom,  Zayo  Group,  Portugal  Telecom,  Slovak 
Telekom,  TDC,  Telus,  Tata  Communieations,  Telefoniea,  AT&T,  Proximus,  Elisa  Corporation, 
Cyta,  Rosteleeom,  Vodafone 
Other  Countries: 

Denmark,  Erance,  Germany,  Netherlands,  United  Kingdom 

•  Gemini  Bermuda 

Owners: 

C&W  Networks 
Other  Country: 

Bermuda 

•  Apollo 

Owners: 

Vodafone 
Other  Countries: 

Eranee,  United  Kingdom 


Manchesten  California,  United  States 


Eoeation:  (123.7°W,  38.97°N) 

1  International  Cable: 

•  Japan-U.S.  Cable  Network  tJUSl 

Owners: 

Verizon,  AT&T,  BT,  Sprint,  CenturyLink,  KDDI,  NTT,  Chunghwa  Telecom,  Tata 
Communications,  SingTel,  Telekom  Malaysia,  Softbank  Teleeom,  Orange,  Level  3,  SK 
Broadband,  KT,  China  Teleeom,  China  Unieom,  LG  Uplus,  HKBN  Enterprise  Solutions, 
Starhub,  PCCW,  Telstra,  Vodafone,  PEDT 
Other  Country: 

Japan 


Landing  24 


Landing  23 
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Miraman  Puerto  Rico,  United  States 


Location:  (66.08°W,  18.45°N) 

2  International  Cables: 

•  Amerieas-II 
Owners: 

Embratel,  AT&T,  Verizon,  Sprint,  CANTV,  Tata  Communications,  Level  3,  Telecom  Argentina, 
Orange,  Portugal  Teleeom,  C&W  Networks,  Teleeom  Italia  Sparkle,  Entel  Chile 
Other  Countries: 

Brazil,  Curasao,  French  Guiana,  Martinique,  Trinidad  and  Tobago,  Venezuela 

•  Antillas  1 
Owners: 

AT&T,  Verizon,  Sprint,  Tata  Communieations,  Orange,  C&W  Networks,  Telecom  Italia 
Sparkle,  Embratel 
Other  Country: 

Dominican  Republic 


Morro  Bay.  California,  United  States 


Eocation:  (120.8°W,  35.37°N) 

2  International  Cables: 

•  Japan-U.S.  Cable  Network  (JUS) 

Owners: 

Verizon,  AT&T,  BT,  Sprint,  CenturyLink,  KDDI,  NTT,  Chunghwa  Teleeom,  Tata 
Communieations,  SingTel,  Telekom  Malaysia,  Softbank  Teleeom,  Orange,  Level  3,  SK 
Broadband,  KT,  China  Teleeom,  China  Unieom,  LG  Uplus,  HKBN  Enterprise  Solutions, 
Starhub,  PCCW,  Telstra,  Vodafone,  PEDT 
Other  Country: 

Japan 

•  Southern  Cross  Cable  Network  (SCCNl 

Owners: 

Spark  New  Zealand,  SingTel  Optus,  Verizon 
Other  Countries: 

Australia,  Fiji,  New  Zealand 


Landing  26 


Landing  25 
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Naples,  FL,  United  States 


Location:  (81.8°W,  26.14°N) 

1  International  Cable: 

•  Deep  Blue  Cable 
Owners: 

Deep  Blue  Cable 
Other  Countries: 

Anguilla,  Aruba,  Bonaire,  Sint  Eustatius,  and  Saba,  Cayman  Islands,  Colombia,  Cura9ao, 
Dominiean  Republie,  Haiti,  Jamaiea,  Panama,  Saint  Martin,  Trinidad  and  Tobago,  Turks  and 
Caieos  Islands 


Nedonna  Beach,  Oregon,  United  States 


Loeation:  (123.9°W,  45.64°N) 

1  International  Cable: 

•  Trans-Paeific  Express  (TPEl  Cable  System 

Owners: 

China  Teleeom,  China  Unieom,  Chunghwa  Teleeom,  KT,  Verizon,  NTT,  AT&T 
Other  Countries: 

China,  Japan,  Taiwan 
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North  Miami  Beach,  Florida,  United  States 


Location:  (80.16°W,  25.93°N) 

1  International  Cable: 

•  ARCOS 
Owners: 

C&W  Networks,  CANTV,  Codetel,  Hondutel,  Belize  Telemedia,  Enitel,  AT&T,  Alestra, 
Verizon,  RACSA,  United  Telecommunication  Services  (UTS),  Teleearrier,  Tricorn  USA, 
Telecomunicaciones  Ultramarinas  de  Puerto  Rieo,  Intemexa,  Orbinet  Overseas,  Telepuerto  San 
Isidro,  Bahamas  Teleeommunieations  Company,  Instituto  Costarrieense  de  Eleetrieidad,  Orbitel 
Other  Countries: 

Bahamas,  Belize,  Colombia,  Costa  Rica,  Cura9ao,  Dominican  Republic,  Guatemala,  Honduras, 
Mexieo,  Niearagua,  Panama,  Turks  and  Caicos  Islands,  Venezuela 


Northport  New  York.  United  States 


Eoeation:  (73.34°W,  40.9 1°N) 

1  International  Cable: 

•  EE  AG  Atlantie  - 1  tPA- 1 1 

Owners: 

Global  Cloud  Xehange 
Other  Countries: 

Eranee,  United  Kingdom 


Landing  30 


Landing  29 
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Pacific  City,  OR,  United  States 


Location:  (124°W,  45.2°N) 

2  International  Cables: 

•  Hawaiki 
Owners: 

Hawaiki  Cable  Company 
Other  Countries: 

Australia,  New  Zealand 

•  New  Cross  Pacific  tNCPl  Cable  System 

Owners: 

China  Teleeom,  China  Unieom,  Chunghwa  Teleeom,  KT,  China  Mobile,  Mierosoft,  Softbank 
Teleeom 
Other  Countries: 

China,  Japan,  Taiwan 


Pago  Pago,  American  Samoa 


Loeation:  (170.7°W,  -14.28°N) 

2  International  Cables: 

•  Hawaiki 
Owners: 

Hawaiki  Cable  Company 
Other  Countries: 

Australia,  New  Zealand 

•  Samoa-Ameriean  Samoa  tSASl 

Owners: 

Ameriean  Samoa  Government,  Elandia 
Other  Country: 

Samoa 


Case  1:15  cv  00662  TSE  Document  168  4  Filed  12/18/18  Pago  1255  of  1208 


Landing  33 


Pitt  Guam 


Location:  (-144.7°W,  13.46°N) 

5  International  Cables: 

•  HANTRUl  Cable  System 


Owners: 

Hannon  Armstrong,  Federated  States  of  Micronesia  Telecommunieations  Company,  Marshall 
Islands  Teleeommunications  Authority 
Other  Country: 

Federated  States  of  Mieronesia 

•  PIPE  Pacific  Cable- 1  tPPC-ll 

Owners: 

TPG 

Other  Countries: 

Australia,  Papua  New  Guinea 

•  Hong  Kong-Guam  tHK-Gl 

Owners: 

RTI  Conneetivity 
Other  Country: 

China 

•  Tata  TGN-Paeifie 


Owners: 

Tata  Communieations 
Other  Country: 

Japan 

•  SEA-US 


Owners: 

RTI,  Inc.,  Globe  Teleeom,  Hawaiian  Teleom,  GTA  TeleGuam,  Telin,  Baku  Submarine  Cable 
Company,  Federated  States  of  Micronesia  Telecommunieations  Company 
Other  Countries: 

Federated  States  of  Micronesia,  Indonesia,  Palau,  Philippines 
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Landing  34 


Redondo  Beach,  California,  United  States 


Location:  (118.4°W,  33.84°N) 
1  International  Cable: 

•  Unitv/EAC-Paeifie 


Owners: 

Telstra,  Google,  Global  Transit,  SingTel,  KDDI,  Airtel  (Bharti) 
Other  Country: 

Japan 
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Landing  35 


San  Juan,  Puerto  Rico,  United  States 


Location:  (66.11°W,  18.47°N) 

7  International  Cables: 

•  Ameriea  Movil  Submarine  Cable  System- 1  tAMX-11 

Owners: 

Ameriea  Movil 
Other  Countries: 

Brazil,  Colombia,  Dominiean  Republie,  Guatemala,  Mexieo 

•  South  Ameriea-1  tSAm-11 

Owners: 

Telxius 

Other  Countries: 

Argentina,  Brazil,  Chile,  Colombia,  Dominiean  Republie,  Eeuador,  Guatemala,  Peru 

•  Deep  Blue  Cable 
Owners: 

Deep  Blue  Cable 
Other  Countries: 

Anguilla,  Aruba,  Bonaire,  Sint  Eustatius,  and  Saba,  Cayman  Islands,  Colombia,  Curasao, 
Dominiean  Republie,  Haiti,  Jamaiea,  Panama,  Saint  Martin,  Trinidad  and  Tobago,  Turks  and 
Caieos  Islands 

•  Global  Caribbean  Network  tGCNl 

Owners: 

Leueadia  National  Corporation,  Loret  Group 
Other  Country: 

Guadeloupe 

•  Paeifie  Caribbean  Cable  System  tPCCSl 

Owners: 

C&W  Networks,  Telconet,  Setar,  United  Teleeommunication  Services  (UTS),  Telxius 
Other  Countries: 

Aruba,  Colombia,  Curasao,  Ecuador,  Panama 

•  Southern  Caribbean  Fiber 


Owners: 

Digieel 

Other  Countries: 

Antigua  and  Barbuda,  Barbados,  Dominiea,  Grenada,  Guadeloupe,  Martinique,  Saint- 
Barthelemy,  Saint  Kitts  and  Nevis,  Saint  Lueia,  Saint  Martin,  Saint  Vincent  and  the  Grenadines, 
Trinidad  and  Tobago 
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Owners; 

Telxius 

Other  Country: 
Brazil 


Landing  36 


San  Luis  Obispo.  California.  United  States 


Location:  (120.7°W,  35.29°N) 

1  International  Cable: 

•  Asia- America  Gateway  lAAG)  Cable  System 

Owners: 

Telekom  Malaysia,  AT&T,  Starhub,  PLDT,  Communications  Authority  of  Thailand,  Airtel 
(Bharti),  Telstra,  Telkom  Indonesia,  BT,  Eastern  Telecom,  PT  Indonesia  Satellite  Corp.,  Spark 
New  Zealand,  Viettel  Corporation,  Saigon  Postel  Corporation,  Vietnam  Telecom  International, 
Brunei  International  Gateway,  BayanTel,  Ezecom 
Other  Countries: 

Brunei,  China,  Malaysia,  Philippines,  Singapore,  Thailand,  Vietnam 


Landing  37 


Sarasota,  Florida,  United  States 


Eocation:  (82.54°W,  27.34°N) 
1  International  Cable; 

•  AURORA 


Owners: 

EP  Telecommunications 
Other  Countries: 

Belize,  Chile,  Colombia,  Costa  Rica,  Ecuador,  Guatemala,  Honduras,  Mexico,  Nicaragua, 
Panama 
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Shirley,  New  York,  United  States 


Location:  (72.87°W,  40.8°N) 

2  International  Cables: 

•  ARConneet  tAECl 

Owners: 

Aqua  Comms 
Other  Country: 

Ireland 

•  Apollo 

Owners: 

Vodafone 
Other  Countries: 

Franee,  United  Kingdom 


Spanish  River  Park,  Florida,  United  States 


Loeation:  (80.07°W,  26.38°N) 

1  International  Cable: 

•  Bahamas  Internet  Cable  System  tBICSl 

Owners: 

Caribbean  Crossings 
Other  Country: 

Bahamas 


Landing  39 


Landing  38 
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Landing  40 


Spencer  Beach,  Hawaii,  United  States 


Location:  (155. 8°W,  20.02°N) 

1  International  Cable: 

•  Southern  Cross  Cable  Network  tSCCNl 

Owners: 

Spark  New  Zealand,  SingTel  Optus,  Verizon 
Other  Countries: 

Australia,  Fiji,  New  Zealand 
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Landing  41 


St.  Croix,  Virgin  Islands,  United  States 


Location:  (64.82°W,  17.77°N) 

5  International  Cables: 

•  South  Ameriean  Crossing  tSACVLatin  Ameriean  Nautilus  tLANl 

Owners: 

Level  3,  Teleeom  Italia  Sparkle 
Other  Countries: 

Argentina,  Brazil,  Chile,  Colombia,  Panama,  Peru,  Venezuela 

•  Amerieas-II 


Owners: 

Embratel,  AT&T,  Verizon,  Sprint,  CANTV,  Tata  Communieations,  Level  3,  Teleeom  Argentina, 
Orange,  Portugal  Teleeom,  C&W  Networks,  Teleeom  Italia  Sparkle,  Entel  Chile 
Other  Countries: 

Brazil,  Curasao,  Freneh  Guiana,  Martinique,  Trinidad  and  Tobago,  Venezuela 

•  Pan  Ameriean  tPAN-AM) 

Owners: 

AT&T,  Telefoniea  del  Peru,  Softbank  Teleeom,  Teleeom  Italia  Sparkle,  Sprint,  CANTV,  Tata 
Communieations,  Telefoniea  de  Argentina,  Telstra,  Verizon,  Entel  Chile,  Teleeom  Argentina, 
Teleonet,  Institute  Costarrieense  de  Eleetrieidad,  C&W  Networks,  Embratel 
Other  Countries: 

Aruba,  Chile,  Colombia,  Ecuador,  Panama,  Peru,  Venezuela 

•  Global  Caribbean  Network  (GCN) 

Owners: 

Eeueadia  National  Corporation,  Eoret  Group 
Other  Country: 

Guadeloupe 

•  Southern  Caribbean  Fiber 


Owners: 

Digicel 

Other  Countries: 

Antigua  and  Barbuda,  Barbados,  Dominiea,  Grenada,  Guadeloupe,  Martinique,  Saint- 
Barthelemy,  Saint  Kitts  and  Nevis,  Saint  Eueia,  Saint  Martin,  Saint  Vineent  and  the  Grenadines, 
Trinidad  and  Tobago 
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Tanguisson  Point 


Location:  (-144.8°W,  13.55°N) 

2  International  Cables: 

•  Asia-Ameriea  Gateway  tAAGl  Cable  System 

Owners: 

Telekom  Malaysia,  AT&T,  Starhub,  PLDT,  Communieations  Authority  of  Thailand,  Airtel 
(Bharti),  Telstra,  Telkom  Indonesia,  BT,  Eastern  Telecom,  PT  Indonesia  Satellite  Corp.,  Spark 
New  Zealand,  Viettel  Corporation,  Saigon  Postel  Corporation,  Vietnam  Teleeom  International, 
Brunei  International  Gateway,  BayanTel,  Ezeeom 
Other  Countries: 

Brunei,  China,  Malaysia,  Philippines,  Singapore,  Thailand,  Vietnam 

•  Australia- Japan  Cable  tAJCI 

Owners: 

Softbank  Teleeom,  Telstra,  Verizon,  AT&T 
Other  Countries: 

Australia,  Japan 


Tuckerton.  New  Jersey.  United  States 


Loeation:  (74.34°W,  39.6°N) 

2  International  Cables: 

•  TAT- 14 
Owners: 

BT,  Verizon,  Deutsehe  Telekom,  Orange,  Sprint,  TeliaSonera,  Level  3,  KPN,  Telenor,  Etisalat, 
OTEGLOBE,  SingTel,  KDDI,  Softbank  Teleeom,  Zayo  Group,  Portugal  Teleeom,  Slovak 
Telekom,  TDC,  Telus,  Tata  Communieations,  Telefoniea,  AT&T,  Proximus,  Elisa  Corporation, 
Cyta,  Rosteleeom,  Vodafone 
Other  Countries: 

Denmark,  Erance,  Germany,  Netherlands,  United  Kingdom 

•  GlobeNet 

Owners: 

BTG  Paetual 
Other  Countries: 

Bermuda,  Brazil,  Colombia,  Venezuela 


Landing  43 


Guam 


Landing  42 


Case  1:15  cv  00662  TSE  Document  168  4  Filed  12/18/18  Pago  1263  of  1208 

Turnon  Bay,  Guam 


Location:  (-144.8°W,  13.5 1°N) 

2  International  Cables: 

•  Guam  Okinawa  Kyushu  Ineheon  tGOKD 

Owners: 

AT&T 

Other  Country: 

Japan 

•  Australia- Japan  Cable  tAJCl 

Owners: 

Softbank  Teleeom,  Telstra,  Verizon,  AT&T 
Other  Countries: 

Australia,  Japan 


Vero  Beach,  Florida,  United  States 


Loeation:  (80.39°W,  27.64°N) 

1  International  Cable: 

•  Bahamas  2 
Owners: 

AT&T,  Telefoniea,  Verizon 
Other  Country: 

Bahamas 


Landing  45 


Landing  44 
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Virginia  Beach,  Virginia,  United  States 

Location:  (76.06°W,  36.76°N) 

3  International  Cables: 

•  MAREA 
Owners: 

Faeebook,  Mierosoft,  Telxius 
Other  Country: 

Spain 

•  Midgardsormen 

Owners: 

Midgardsormen 
Other  Country: 

Denmark 

•  BRUSA 

Owners: 

Telxius 

Other  Country: 

Brazil 


Wall  Township.  New  Jersey.  United  States 


Loeation:  (74.06°W,  40.15°N) 

2  International  Cables: 

•  Tata  TGN-Atlantie 
Owners: 

Tata  Communieations 
Other  Country: 

United  Kingdom 

•  Seabras-1 

Owners: 

Seaborn  Group 
Other  Country: 

Brazil 
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International  Submarine  Cables  Landing  in  the  US 


AEConnect  (AEC) 


More  info: 

http://www.aquacomms.com 

Owners: 

Aqua  Comms 
Length: 

5,536  km 
US  Landing  Point: 

•  Shirley.  New  York,  United  States 

Other  Country: 

Ireland 


America  Movil  Submarine  Cable  Svstem-1  (AMX-1) 


More  info: 

http://www.americamovil.com 

Owners: 

America  M6vil 
Length: 

17,800  km 
US  Landing  Points: 

•  Hollywood.  Florida.  United  States 

•  Jacksonville.  Florida.  United  States 

•  San  Juan.  Puerto  Rico.  United  States 

Other  Countries: 

Brazil,  Colombia,  Dominican  Republic,  Guatemala,  Mexico 


Cable  2 


Cable  1 
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Americas-II 


Owners: 

Embratel,  AT&T,  Verizon,  Sprint,  CANTV,  Tata  Communieations,  Level  3,  Teleeom  Argentina, 
Orange,  Portugal  Telecom,  C&W  Networks,  Telecom  Italia  Sparkle,  Entel  Chile 
Length: 

8,373  km 

US  Landing  Points: 


•  Hollywood.  Llorida.  United  States 

•  Miramar.  Puerto  Rico.  United  States 

•  St.  Croix.  Virgin  Islands.  United  States 

Other  Countries: 

Brazil,  Curasao,  Lrench  Guiana,  Martinique,  Trinidad  and  Tobago,  Venezuela 


Antillas  1 


Owners: 

AT&T,  Verizon,  Sprint,  Tata  Communications,  Orange,  C&W  Networks,  Telecom  Italia  Sparkle, 
Embratel 
Length: 

650  km 

US  Landing  Points: 

•  Isla  Verde.  Puerto  Rico.  United  States 

•  Miramar.  Puerto  Rico.  United  States 


Other  Country: 

Dominican  Republic 
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Apollo 


More  info: 

http://www.vodafone.coin/business/article-cs-apollo-submarine-cable-svstem 

Owners: 

Vodafone 

Length: 

13,000  km 
US  Landing  Points: 

•  Manasquan,  New  Jersey.  United  States 

•  Shirley.  New  York.  United  States 

Other  Countries: 

France,  United  Kingdom 


ARCOS 


More  info: 

http://www.cwnetworks.com/ 

Owners: 

C&W  Networks,  CANTV,  Codetel,  Hondutel,  Belize  Telemedia,  Enitel,  AT&T,  Alestra,  Verizon, 
RACSA,  United  Telecommunication  Services  (UTS),  Telecarrier,  Tricorn  USA,  Telecomunicaciones 
Ultramarinas  de  Puerto  Rico,  Internexa,  Orbinet  Overseas,  Telepuerto  San  Isidro,  Bahamas 
Telecommunications  Company,  Instituto  Costarricense  de  Electricidad,  Orbitel 
Eength: 

8,600  km 

US  Landing  Points: 

•  North  Miami  Beach.  Florida.  United  States 

•  Isla  Verde.  Puerto  Rico.  United  States 

Other  Countries: 

Bahamas,  Belize,  Colombia,  Costa  Rica,  Curasao,  Dominican  Republic,  Guatemala,  Flonduras, 
Mexico,  Nicaragua,  Panama,  Turks  and  Caicos  Islands,  Venezuela 


Cable  6 


Cable  5 
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Asia- America  Gateway  (AAG)  Cable  System 


More  info: 

http://www.asia-america-gatewav.com 

Owners: 

Telekom  Malaysia,  AT&T,  Starhub,  PLOT,  Communications  Authority  of  Thailand,  Airtel  (Bharti), 
Telstra,  Telkom  Indonesia,  BT,  Eastern  Telecom,  PT  Indonesia  Satellite  Corp.,  Spark  New  Zealand, 
Viettel  Corporation,  Saigon  Postel  Corporation,  Vietnam  Telecom  International,  Brunei  International 
Gateway,  BayanTel,  Ezecom 
Length: 

20,000  km 
US  Landing  Points: 

•  Keawaula,  Hawaii.  United  States 

•  San  Luis  Obispo.  California,  United  States 

•  Tanguisson  Point.  Guam 

Other  Countries: 

Brunei,  China,  Malaysia,  Philippines,  Singapore,  Thailand,  Vietnam 


Atlantic  Crossing-1  (AC- 


More  info: 

http://www.level3.com 

Owners: 

Level  3 
Length: 

14,301  km 
US  Landing  Point: 

•  Brookhaven.  New  York.  United  States 
Other  Countries: 

Germany,  Netherlands,  United  Kingdom 


Cable  8 


Cable  7 
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AURORA 


More  info: 

http://fptelecoms.com/ 

Owners: 

FP  Telecommunications 
Length: 

n.a. 

US  Landing  Point: 

•  Sarasota.  Florida.  United  States 
Other  Countries: 

Belize,  Chile,  Colombia,  Costa  Rica,  Ecuador,  Guatemala,  Honduras,  Mexico,  Nicaragua,  Panama 


Australia-Japan  Cable  (AJC) 


More  info: 

http://www.aicable.com 

Owners: 

Softbank  Telecom,  Telstra,  Verizon,  AT&T 
Length: 

12,700  km 
US  Landing  Points: 


Tanguisson  Point.  Guam 

Turnon  Bay.  Guam 


Other  Countries: 

Australia,  Japan 
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Bahamas  2 


Owners: 

AT&T,  Telefonica,  Verizon 
Length: 

470  km 

US  Landing  Point: 


Vero  Beach.  Florida.  United  States 


Other  Country: 
Bahamas 


Bahamas  Internet  Cable  System  (BICS) 


More  info: 

http://www.caribbeancrossings.com 

Owners: 

Caribbean  Crossings 
Length: 

1,100  km 

US  Landing  Points: 

•  Boca  Raton.  FL.  United  States 

•  Spanish  River  Park.  Florida.  United  States 

Other  Country: 

Bahamas 
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BRUSA 


More  info: 

http://www.telxius.com 

Owners: 

Telxius 

Length: 

11,000  km 
US  Landing  Points: 

•  San  Juan.  Puerto  Rico.  United  States 

•  Virginia  Beach.  Virginia.  United  States 

Other  Country: 

Brazil 


Challenger  Bermuda-1  (CB-1) 


More  info: 

http://cableco.bm 

Owners: 

Cable  Co. 

Length: 

1,448  km 

US  Landing  Point: 

•  Charlestown.  Rhode  Island.  United  States 

Other  Country: 

Bermuda 


Cable  14 


Cable  13 
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Colombia-Florida  Subsea  Fiber  (CFX-1) 


More  info: 

http://www.cwnetworks.coin/ 

Owners: 

C&W  Networks 
Length: 

2,400  km 
US  Landing  Point: 

•  Boca  Raton.  FL,  United  States 

Other  Countries: 

Colombia,  Jamaica 


Columbus-III 


Owners: 

Telecom  Italia  Sparkle,  AT&T,  Verizon,  Telefonica,  Portugal  Telecom,  Tata  Communications, 
Ukrtelecom,  Telkom  South  Africa,  Telecom  Argentina,  Institute  Costarricense  de  Electricidad, 
Embratel,  Cyta 
Eength: 

9,833  km 
US  Eanding  Point: 

•  Hollywood.  Elorida.  United  States 

Other  Countries: 

Italy,  Portugal,  Spain 


Cable  16 


Cable  15 
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Crosslake  Fibre 


More  info: 

http://www.crosslakefibre.ca 

Owners: 

Crosslake  Fibre 
Length: 

131  km 

US  Landing  Point: 

•  Buffalo.  New  York.  United  States 

Other  Country: 

Canada 


Deep  Blue  Cable 


More  info: 

http://www.deepbluecable.com 

Owners: 

Deep  Blue  Cable 
Length: 

12,000  km 
US  Landing  Points: 

•  Boca  Raton.  FL.  United  States 

•  San  Juan.  Puerto  Rico.  United  States 

•  Naples.  FL.  United  States 

Other  Countries: 

Anguilla,  Aruba,  Bonaire,  Sint  Eustatius,  and  Saba,  Cayman  Islands,  Colombia,  Cura9ao,  Dominican 
Republic,  Haiti,  Jamaica,  Panama,  Saint  Martin,  Trinidad  and  Tobago,  Turks  and  Caicos  Islands 


Cable  18 


Cable  17 
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FASTER 


Owners: 

Google,  KDDI,  SingTel,  China  Telecom,  China  Mobile,  Global  Transit 
Length: 

11,629  km 
US  Landing  Point: 

•  Bandon.  Oregon.  United  States 

Other  Countries: 

Japan,  Taiwan 


FLAG  Atlantic-1  (FA-1) 


More  info: 

http://www.globalcloudxchange.com 

Owners: 

Global  Cloud  Xchange 
Length: 

14,500  km 
US  Landing  Points: 

•  Island  Park.  New  York.  United  States 

•  Northport.  New  York.  United  States 

Other  Countries: 

France,  United  Kingdom 
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Gemini  Bermuda 


More  info: 

http://www.cwnetworks.com 

Owners: 

C&W  Networks 
Length: 

1,287  km 

US  Landing  Point: 

•  Manasquan,  New  Jersey.  United  States 

Other  Country: 

Bermuda 


Global  Caribbean  Network  (GCN) 


More  info: 

http://www.globalcaribbean.net 

Owners: 

Leucadia  National  Corporation,  Loret  Group 
Length: 
n.a. 

US  Landing  Points: 

•  San  Juan.  Puerto  Rico.  United  States 

•  St.  Croix.  Virgin  Islands.  United  States 

Other  Country: 

Guadeloupe 


Cable  22 


Cable  21 
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More  info: 

http://www.globenet.net 

Owners: 

BTG  Paetual 
Length: 

23,500  km 
US  Landing  Points: 

•  Boea  Raton.  FL,  United  States 

•  Tuekerton.  New  Jersey.  United  States 

Other  Countries: 

Bermuda,  Brazil,  Colombia,  Venezuela 


GTT  Atlantic 


More  info: 

http://www.gtt.net 

Owners: 

GTT 

Length: 

12,200  km 
US  Landing  Point: 

•  T.ynn.  Massaehusetts.  United  States 
Other  Countries: 

Canada,  Ireland,  United  Kingdom 


Cable  24 


GlobeNet 


Cable  23 
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Guam  Okinawa  Kyushu  Incheon  (GOKI) 


More  info: 

http://www.att.com 

Owners: 

AT&T 

Length: 

4,244  km 
US  Landing  Point: 

•  Turnon  Bay,  Guam 

Other  Country: 

Japan 


HANTRUl  Cable  System 


Owners: 

Hannon  Armstrong,  Federated  States  of  Micronesia  Telecommunications  Company,  Marshall  Islands 
Telecommunications  Authority 
Length: 

2,917  km 
US  Landing  Point: 

•  Piti.  Guam 

Other  Country: 

Federated  States  of  Micronesia 
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Hawaiki 


More  info: 

http://hawaikicable.co.nz 

Owners: 

Hawaiki  Cable  Company 
Length: 

14,000  km 
US  Landing  Points: 


Kapolei.  HI,  United  States 
Pacific  City.  OR.  United  States 

Pago  Pago,  American  Samoa 


Other  Countries: 

Australia,  New  Zealand 


Hong  Kong-Guam  (HK-G) 


Owners: 

RTI  Connectivity 
Length: 

3,900  km 
US  Landing  Point: 

•  Piti.  Guam 

Other  Country: 

China 
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Honotua 


More  info: 

http://www.opt.pf 

Owners: 

OPT  French  Polynesia 
Length: 

4,805  km 
US  Landing  Point: 

•  Kawaihae.  Hawaii.  United  States 

Other  Country: 

French  Polynesia 


Japan-U.S.  Cable  Network  (JUS) 


Owners: 

Verizon,  AT&T,  BT,  Sprint,  CenturyLink,  KDDI,  NTT,  Chunghwa  Telecom,  Tata  Communications, 
SingTel,  Telekom  Malaysia,  Softbank  Telecom,  Orange,  Level  3,  SK  Broadband,  KT,  China  Telecom, 
China  Unicom,  LG  Uplus,  HKBN  Enterprise  Solutions,  Starhub,  PCCW,  Telstra,  Vodafone,  PLDT 
Length: 

22,682  km 
US  Landing  Points: 

•  Makaha.  Hawaii.  United  States 

•  Manchester.  California.  United  States 

•  Morro  Bay.  California.  United  States 

Other  Country: 

Japan 
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JUPITER 


Owners: 

Amazon,  Facebook,  NTT,  PLDT,  PCCW,  Softbank  Telecom 
Length: 

14,000  km 
US  Landing  Point: 

•  Hermosa  Beach.  California.  United  States 

Other  Countries: 

Japan,  Philippines 


MAREA 


Owners: 

Facebook,  Microsoft,  Telxius 
Length: 

6,605  km 
US  Landing  Point: 


Virginia  Beach.  Virginia.  United  States 


Other  Country: 
Spain 


Mava-1 


More  info: 

http  ://www.maya-l  .com 
Owners: 

Verizon,  AT&T,  Sprint,  Hondutel,  Telefonica,  Orbitel,  Telecom  Italia  Sparkle,  C&W  Networks,  Entel 
Chile,  Embratel,  ETB,  Axtel,  Instituto  Costarricense  de  Electricidad,  Proximus,  Prepa  Networks, 
Orange,  Tricorn,  RSL  Telecom,  America  M6vil 
Length: 

4,400  km 
US  Landing  Point: 

•  Hollywood.  Elorida,  United  States 

Other  Countries: 

Cayman  Islands,  Colombia,  Costa  Rica,  Honduras,  Mexico,  Panama 
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Midgardsormen 


More  info: 

http://midgardsormen.net 

Owners: 

Midgardsormen 

Length: 

7,848  km 
US  Landing  Point: 


Virginia  Beaeh,  Virginia.  United  States 


Other  Country: 
Denmark 


Monet 


Owners: 

Angola  Cables,  Google,  Algar  Teleeom,  Antel  Uruguay 
Length: 

10,556  km 
US  Landing  Point: 

•  Boea  Raton.  FL.  United  States 

Other  Country: 

Brazil 


New  Cross  Pacific  (NCP)  Cable  System 


Owners: 

China  Telecom,  China  Unicom,  Chunghwa  Telecom,  KT,  China  Mobile,  Microsoft,  Softbank  Telecom 
Length: 

13,618  km 
US  Landing  Point: 

•  Pacific  City.  OR.  United  States 

Other  Countries: 

China,  Japan,  Taiwan 
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Pacific  Caribbean  Cable  System  (PCCS) 


Owners: 

C&W  Networks,  Teleonet,  Setar,  United  Telecommunieation  Serviees  (UTS),  Telxius 
Length: 

6,000  km 

US  Landing  Points: 

•  Jaeksonville.  Florida.  United  States 

•  San  Juan.  Puerto  Rieo.  United  States 

Other  Countries: 

Aruba,  Colombia,  Cura9ao,  Eeuador,  Panama 


Pacific  Crossing-1  (PC-1) 


More  info: 

http://www.pc  1  .eom 
Owners: 

NTT 

Length: 

20,900  km 
US  Landing  Points: 

•  Grover  Beach.  California.  United  States 

•  Harbour  Pointe.  Washington.  United  States 

Other  Country: 

Japan 


Cable  38 


Cable  37 
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Pacific  Light  Cable  Network  (PLCN) 


More  info: 

http://pldc.com.lik 

Owners: 

Pacific  Light  Data  Communication  Co.  Ltd.,  Google,  Facebook 
Length: 

12,871  km 
US  Landing  Point: 

•  El  Segundo.  California.  United  States 

Other  Countries: 

China,  Philippines,  Taiwan 


Pan-American  Crossing  (PAC) 


More  info: 

http://www.level3.com 

Owners: 

Level  3 
Length: 

10,000  km 
US  Landing  Point: 

•  Grover  Beach.  California.  United  States 

Other  Countries: 

Costa  Rica,  Mexico,  Panama 


Cable  40 


Cable  39 
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Pan  American  (PAN-AM) 


Owners: 

AT&T,  Telefonica  del  Peru,  Softbank  Telecom,  Telecom  Italia  Sparkle,  Sprint,  CANTV,  Tata 
Communications,  Telefonica  de  Argentina,  Telstra,  Verizon,  Entel  Chile,  Telecom  Argentina, 
Telconet,  Institute  Costarricense  de  Electricidad,  C&W  Networks,  Embratel 
Eength: 

7,050  km 
US  Eanding  Point: 

•  St.  Croix.  Virgin  Islands.  United  States 
Other  Countries: 

Aruba,  Chile,  Colombia,  Ecuador,  Panama,  Peru,  Venezuela 


PIPE  Pacific  Cable-1  (PPC-1) 


More  info: 

http://www.pipenetworks.com/ppc  1 
Owners: 

TPG 

Eength: 

6,900  km 
US  Eanding  Point: 

•  Piti.  Guam 

Other  Countries: 

Australia,  Papua  New  Guinea 


Saint  Maarten  Puerto  Rico  Network  One  (SMPR-1) 


Owners: 

TelEm  Group,  Dauphin  Telecom 
Length: 

375  km 

US  Landing  Point: 

•  Isla  Verde.  Puerto  Rico.  United  States 

Other  Countries: 

Saint  Martin,  Sint  Maarten 


Cable  43 


Cable  42 


Cable  41 
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Samoa- American  Samoa  (SAS) 


Owners: 

American  Samoa  Government,  Elandia 
Length: 

250  km 

US  Landing  Point: 

•  Pago  Pago.  American  Samoa 

Other  Country: 

Samoa 


Seabras-1 


More  info: 

http://www.seabornnetworks.com 

Owners: 

Seaborn  Group 
Length: 

10,800  km 
US  Landing  Point: 

•  Wall  Township.  New  Jersey,  United  States 

Other  Country: 

Brazil 


Cable  45 


Cable  44 
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SEA-US 


Owners: 

RTI,  Inc.,  Globe  Telecom,  Hawaiian  Telcom,  GTA  TeleGuam,  Telin,  Baku  Submarine  Cable 
Company,  Federated  States  of  Micronesia  Telecommunications  Company 
Length: 

14,500  km 
US  Landing  Points: 

•  Hermosa  Beach.  California.  United  States 

•  Makaha.  Hawaii.  United  States 

•  Piti.  Guam 

Other  Countries: 

Federated  States  of  Micronesia,  Indonesia,  Palau,  Philippines 


South  America-1  (SAm-1) 


More  info: 

http://www.telxius.com/ 

Owners: 

Telxius 

Length: 

25,000  km 
US  Landing  Points: 

•  Boca  Raton.  FL,  United  States 

•  San  Juan.  Puerto  Rico.  United  States 

Other  Countries: 

Argentina,  Brazil,  Chile,  Colombia,  Dominican  Republic,  Ecuador,  Guatemala,  Peru 


Cable  47 


Cable  46 
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South  American  Crossing  (SACVLatin  American 

Nautilus  (LAN) 


More  info: 

http://www.level3.com 

Owners: 

Level  3,  Telecom  Italia  Sparkle 
Length: 

20,000  km 
US  Landing  Point: 

•  St.  Croix.  Virgin  Islands.  United  States 
Other  Countries: 

Argentina,  Brazil,  Chile,  Colombia,  Panama,  Peru,  Venezuela 


South  America  Pacific  Link  (SAPL) 


More  info: 

http://www.oceannetworks.com 

Owners: 

Ocean  Networks 
Length: 

17,600  km 
US  Landing  Points: 

•  Jacksonville.  Florida.  United  States 

•  Makaha.  Hawaii.  United  States 


Other  Countries: 

Chile,  Panama 
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Southern  Caribbean  Fiber 


More  info: 

http://www.southern-caribbean.com 

Owners: 

Digicel 

Length: 

n.a. 

US  Landing  Points: 

•  San  Juan.  Puerto  Rico.  United  States 

•  St.  Croix.  Virgin  Islands.  United  States 

Other  Countries: 

Antigua  and  Barbuda,  Barbados,  Dominica,  Grenada,  Guadeloupe,  Martinique,  Saint-Barthelemy, 
Saint  Kitts  and  Nevis,  Saint  Lucia,  Saint  Martin,  Saint  Vincent  and  the  Grenadines,  Trinidad  and 
Tobago 


Southern  Cross  Cable  Network  (SCCN) 


More  info: 

http://www.southerncrosscables.com 

Owners: 

Spark  New  Zealand,  SingTel  Optus,  Verizon 
Length: 

30,500  km 
US  Landing  Points: 

•  Hillsboro.  Oregon.  United  States 

•  Kahe  Point.  Hawaii.  United  States 

•  Morro  Bay.  California.  United  States 

•  Spencer  Beach.  Hawaii.  United  States 

Other  Countries: 

Australia,  Fiji,  New  Zealand 


Cable  51 


Cable  50 
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TAT-14 


More  info: 

https://www.tat-14.com 

Owners: 

BT,  Verizon,  Deutsche  Telekom,  Orange,  Sprint,  TeliaSonera,  Level  3,  KPN,  Telenor,  Etisalat, 
OTEGLOBE,  SingTel,  KDDI,  Softbank  Telecom,  Zayo  Group,  Portugal  Telecom,  Slovak  Telekom, 
TDC,  Telus,  Tata  Communications,  Telefonica,  AT&T,  Proximus,  Elisa  Corporation,  Cyta, 
Rostelecom,  Vodafone 
Length: 

15,295  km 
US  Landing  Points: 

•  Manasquan.  New  Jersey.  United  States 

•  Tuckerton,  New  Jersey.  United  States 

Other  Countries: 

Denmark,  France,  Germany,  Netherlands,  United  Kingdom 


Tata  TGN- Atlantic 


More  info: 

http://www.tatacommunications.com 

Owners: 

Tata  Communications 
Length: 

13,000  km 
US  Landing  Point: 

•  Wall  Township.  New  Jersey.  United  States 

Other  Country: 

United  Kingdom 
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Tata  TGN-Pacific 


More  info: 

http://www.tatacommunications.com 

Owners: 

Tata  Communications 
Length: 

22,300  km 
US  Landing  Points: 

•  Hillsboro.  Oregon.  United  States 

•  Los  Angeles.  California.  United  States 

•  Piti.  Guam 

Other  Country: 

Japan 


Telstra  Endeavour 


More  info: 

https://www.telstraglobal.com 

Owners: 

Telstra 

Length: 

9,125  km 
US  Landing  Point: 

•  Keawaula.  Hawaii.  United  States 

Other  Country: 

Australia 
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Trans-Pacific  Express  (TPE)  Cable  System 


More  info: 

http://tpecable.org 

Owners: 

China  Telecom,  China  Unicom,  Chunghwa  Telecom,  KT,  Verizon,  NTT,  AT&T 
Length: 

17,000  km 
US  Landing  Point: 

•  Nedonna  Beach.  Oregon.  United  States 

Other  Countries: 

China,  Japan,  Taiwan 


Unitv/E  AC -Pacific 


Owners: 

Telstra,  Google,  Global  Transit,  SingTel,  KDDI,  Airtel  (Bharti) 
Length: 

9,620  km 
US  Landing  Point: 

•  Redondo  Beach.  California.  United  States 

Other  Country: 

Japan 


Yellow 


More  info: 

http://www.level3.com 

Owners: 

Level  3 
Length: 

7,001  km 
US  Landing  Point: 


Bellport,  New  York,  United  States 


Other  Country: 

United  Kingdom 
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Country,  Territory,  or  Region 

Number  of  HTTPS  Requests  to 
Wikimedia's  U.S.  Servers  from 

April  23,  2017  to  December  31,  2017 

Afghanistan 

20369894 

Aland 

117152 

Albania 

9813195 

Algeria 

156438189 

Andorra 

316946 

Angola 

105745420 

Anguilla 

4426739 

Antigua  and  Barbuda 

48037599 

Argentina 

19010881507 

Armenia 

18140327 

Aruba 

64193040 

Australia 

27114015484 

Austria 

52611694 

Azerbaijan 

107261925 

Bahamas 

151162707 

Bahrain 

8619910 

Bangladesh 

3176953826 

Barbados 

158106659 

Belarus 

84619956 

Belgium 

76321220 

Belize 

67244483 

Benin 

25265648 

Bermuda 

55289619 

Bhutan 

50416741 

Bolivia 

2018496453 

Bonaire,  Sint  Eustatius,  and  Saba 

13719337 

Bosnia  and  Herzegovina 

7960706 

Botswana 

2492444 

Brazil 

42781878450 

British  Indian  Ocean  Territory 

14140 

British  Virgin  Islands 

10461523 

Brunei 

204756696 

Bulgaria 

41739970 

Burkina  Faso 

72081285 

Burundi 

26725989 

Cabo  Verde 

882511 

Cambodia 

472574422 

Cameroon 

116414708 

Canada 

48324693988 

Cayman  Islands 

54000322 

Central  African  Republic 

1283047 

Chad 

40213806 

Chile 

9659037697 
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China 

12584652290 

Christmas  Island 

579670 

Cocos  [Keeling]  Islands 

106232 

Colombia 

16167706781 

Comoros 

1091223 

Congo 

195263297 

Cook  Islands 

4088747 

Costa  Rica 

1778677233 

Croatia 

19440436 

Cuba 

241281047 

Curasao 

83087694 

Cyprus 

8347851 

Czechia 

74427132 

Denmark 

41180871 

Djibouti 

2292821 

Dominica 

17578663 

Dominican  Republic 

2729299547 

East  Timor 

35559845 

Ecuador 

5171181590 

Egypt 

68341152 

El  Salvador 

1257386602 

Equatorial  Guinea 

772007 

Eritrea 

60580 

Estonia 

9430466 

Ethiopia 

85497296 

Falkland  Islands 

42130 

Faroe  Islands 

195220 

Federated  States  of  Micronesia 

6012383 

Fiji 

111027541 

Finland 

34542127 

France 

428122202 

French  Guiana 

24749484 

French  Polynesia 

105399149 

French  Southern  Territories 

743 

Gabon 

22322222 

Gambia 

5715554 

Georgia 

25583815 

Germany 

681511112 

Ghana 

44290723 

Gibraltar 

446362 

Greece 

53903595 

Greenland 

19382135 

Grenada 

35156030 

Guadeloupe 

87446940 

Guatemala 

2143452845 

Guernsey 

361898 

Guinea 

71901723 
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Guinea-Bissau 

3706011 

Guyana 

108894211 

Haiti 

359392927 

Hashemite  Kingdom  of  Jordan 

97594115 

Honduras 

1110628708 

Hong  Kong 

11662091368 

Hungary 

55141049 

Iceland 

3140460 

India 

4776424926 

Indonesia 

17930654308 

Iran 

169551705 

Iraq 

27532939 

Ireland 

2915689068 

Isle  of  Man 

420522 

Israel 

136663663 

Italy 

308507489 

Ivory  Coast 

4788982 

Jamaica 

541057089 

Japan 

113000000000 

Jersey 

438591 

Kazakhstan 

48793066 

Kenya 

61816471 

Kiribati 

2309857 

Kosovo 

440768 

Kuwait 

15390854 

Kyrgyzstan 

28319444 

Laos 

146029975 

Latvia 

11396822 

Lebanon 

14769754 

Lesotho 

12138382 

Liberia 

22366792 

Libya 

10894231 

Liechtenstein 

383883 

Luxembourg 

7386689 

Macao 

550047603 

Macedonia 

6785331 

Madagascar 

50887134 

Malawi 

6410883 

Malaysia 

8647611090 

Maldives 

124882076 

Mali 

30779056 

Malta 

3444213 

Marshall  Islands 

3903305 

Martinique 

113112912 

Mauritania 

7266862 

Mauritius 

3235747 

Mayotte 

384633 
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Mexico 

34178655407 

Monaco 

760422 

Mongolia 

378557613 

Montenegro 

3163785 

Montserrat 

1703867 

Morocco 

75093242 

Mozambique 

23042895 

Myanmar  [Burma] 

555925780 

Namibia 

1364089 

Nauru 

716431 

Nepal 

824458922 

Netherlands 

314138585 

New  Caledonia 

146196439 

New  Zealand 

4974407925 

Nicaragua 

663794290 

Niger 

12893334 

Nigeria 

63405617 

Niue 

228788 

Norfolk  Island 

165666 

North  Korea 

1161183 

Norway 

48334001 

Oman 

7345673 

Pakistan 

481888376 

Palau 

3878789 

Palestine 

11882097 

Panama 

1733368181 

Papua  New  Guinea 

70580002 

Paraguay 

1101016965 

Peru 

10036096249 

Philippines 

12481173527 

Pitcairn  Islands 

24226 

Poland 

274029978 

Portugal 

36859280 

Qatar 

17430941 

Republic  of  Korea 

11895460720 

Republic  of  Lithuania 

14924046 

Republic  of  Moldova 

15966392 

Republic  of  the  Congo 

10928527 

Reunion 

2596349 

Romania 

140435673 

Russia 

401995918 

Rwanda 

36617960 

Saint  Helena 

3361 

Saint  Kitts  and  Nevis 

10037867 

Saint  Lucia 

52811468 

Saint  Martin 

9020272 

Saint  Pierre  and  Miquelon 

6559606 
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Saint  Vincent  and  the  Grenadines 

26989667 

Saint-Barthelemy 

448558 

Samoa 

5361146 

San  Marino 

84815 

Sao  Tome  and  Principe 

315703 

Saudi  Arabia 

54880396 

Senegal 

20064032 

Serbia 

50231403 

Seychelles 

1255981 

Sierra  Leone 

23469731 

Singapore 

7218003729 

Sint  Maarten 

20016168 

Slovak  Republic 

8194905 

Slovakia 

13986326 

Slovenia 

6709561 

Solomon  Islands 

11992687 

Somalia 

14276645 

South  Africa 

41439302 

South  Georgia  and  the  South 
Sandwich  Islands 

25507 

South  Sudan 

13351919 

Spain 

181252108 

Sri  Lanka 

72364979 

St  Kitts  and  Nevis 

11384455 

Sudan 

25095741 

Suriname 

112376817 

Svalbard  and  Jan  Mayen 

9060 

Swaziland 

13495244 

Sweden 

64789765 

Switzerland 

78135290 

Syria 

33031303 

Taiwan 

26446703306 

Tajikistan 

61431060 

Tanzania 

51538316 

Thailand 

10518810064 

Togo 

13185655 

Tokelau 

34305 

Tonga 

5398379 

Trinidad  and  Tobago 

475418043 

Tunisia 

33320421 

Turkey 

2067814073 

Turkmenistan 

1973624 

Turks  and  Caicos  Islands 

13438622 

Tuvalu 

160716 

Uganda 

169288227 

Ukraine 

507837265 

United  Arab  Emirates 

73046384 
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United  Kingdom 

718823645 

Uruguay 

2012643741 

Uzbekistan 

29477693 

Vanuatu 

13851682 

Vatican  City 

43867 

Venezuela 

7548335270 

Vietnam 

9042940682 

Wallis  and  Futuna 

2022934 

Western  Sahara 

3149 

Yemen 

9262140 

Zambia 

87273901 

Zimbabwe 

55138516 

